PaperlayerView exact revision on arXiv

Source-linked AI summary

Variational Bayesian Unlearning

Quoc Phong Nguyen, Bryan Kian Hsiang Low, Patrick Jaillet

arXiv:2010.12883v1cs.LGstat.ML

TL;DR

The paper addresses approximate Bayesian unlearning when a small subset of training data must be erased without retraining on the large remainder. It uses VI to optimize an evidence upper bound and introduces adjusted-likelihood and reverse-KL tricks, with empirical demonstrations on Bayesian models and datasets.

  • Problem

    Approximate Bayesian unlearning seeks to recover an approximate posterior for remaining data using the full-data approximate posterior and erased data, avoiding costly retraining while coping with VI inaccuracies.

  • Method

    The paper minimizes posterior KL divergence through an evidence upper bound, then uses adjusted likelihood and reverse KL to curb unlearning in low-approximate-posterior regions.

  • Results

    Empirical evaluations demonstrate the unlearning methods on sparse Gaussian processes and logistic regression with synthetic and real-world datasets.

  • Takeaways & Limitations

    The methods provide parsimonious approximate Bayesian unlearning using only the full-data approximate posterior and erased data.

  • Takeaways & Limitations

    Performance for large or distributionally different erased sets depends on the posterior-belief difference between remaining and full data, especially where q(θ|D) is small.

Abstract

from arXiv · show

This paper studies the problem of approximately unlearning a Bayesian model from a small subset of the training data to be erased. We frame this problem as one of minimizing the Kullback-Leibler divergence between the approximate posterior belief of model parameters after directly unlearning from erased data vs. the exact posterior belief from retraining with remaining data. Using the variational inference (VI) framework, we show that it is equivalent to minimizing an evidence upper bound which trades off between fully unlearning from erased data vs. not entirely forgetting the posterior belief given the full data (i.e., including the remaining data); the latter prevents catastrophic unlearning that can render the model useless. In model training with VI, only an approximate (instead of exact) posterior belief given the full data can be obtained, which makes unlearning even more challenging. We propose two novel tricks to tackle this challenge. We empirically demonstrate our unlearning methods on Bayesian models such as sparse Gaussian process and logistic regression using synthetic and real-world datasets.

1 Introduction

Machine unlearning seeks to remove a small subset of training data from an ML model without costly full retraining. For Bayesian models, the paper formulates approximate unlearning through VI and introduces methods designed to preserve useful information from remaining data.

  • Motivation: Machine unlearning addresses data-erasure requests and malicious-data removal after training.The motivation includes users’ right to be forgotten and practical cases involving anomalies.
  • Problem: Retraining from scratch on the remaining data is often prohibitively expensive, while exact unlearning is available only for selected models.The paper therefore asks how to directly and approximately unlearn a small erased subset.
  • Approach: The proposed loss measures KL divergence between the directly unlearned approximate posterior and the exact posterior obtained from retraining with remaining data.Within VI, minimizing this divergence is equivalent to minimizing an evidence upper bound.
  • Approach: The evidence upper bound trades off fully unlearning erased data against retaining the full-data posterior, which prevents catastrophic unlearning.Catastrophic unlearning is defined as performance considerably worse than retraining with remaining data.
  • Challenges and solutions: Approximate full-data posteriors create additional unlearning challenges, motivating adjusted-likelihood and reverse-KL tricks.The adjusted likelihood curbs unlearning in low-posterior regions; reverse KL is less exposed to the associated inaccuracy without requiring that adjustment.
  • Evaluation: Experiments evaluate the methods on sparse Gaussian processes and logistic regression using synthetic and real-world datasets.The approximate posterior is modeled with a normalizing flow in the reported demonstrations.

2 Variational Inference (VI)

Variational inference approximates a Bayesian posterior by optimizing an ELBO, balancing data likelihood against retention of the prior. Stochastic optimization and expressive posterior parameterizations make VI applicable when the objective is not analytically tractable.

  • Posterior approximation: VI learns an approximate posterior q(θ|D) for parameters θ by minimizing KL divergence to the exact posterior p(θ|D).This objective is equivalent to maximizing the evidence lower bound.
  • ELBO: The ELBO equals log p(D) minus posterior KL divergence, so it is a lower bound on the log marginal likelihood.The log marginal likelihood is independent of q(θ|D).
  • ELBO: The ELBO balances achieving higher likelihood for D against not entirely forgetting the prior belief p(θ).These correspond to the ELBO’s likelihood and prior-related terms.
  • Optimization: When the ELBO is not available in closed form, stochastic gradient ascent optimizes it by approximating expectations through stochastic sampling.Sampling is performed within each optimization iteration.
  • Posterior representations: Posterior q(θ|D) may use simple distributions for computational ease or generative neural networks for expressive power.Adversarial training can optimize the ELBO when a generative network’s density cannot be evaluated.

3 Bayesian Unlearning

Bayesian unlearning targets the posterior obtained from remaining data without costly retraining. The paper derives EUBO-based unlearning and introduces adjusted-likelihood and reverse-KL strategies to address inaccuracies in VI posteriors.

  • 3.1 Exact Bayesian Unlearning: Exact Bayesian unlearning recovers p(θ|Dr) from p(θ|D) by directly removing erased data De, avoiding retraining on Dr.The data partition is D = Dr ∪ De, with Dr and De disjoint.
  • 3.2 Approximate Bayesian Unlearning: Approximate unlearning instead targets posterior divergence because predictive-distribution KL may be difficult to evaluate in closed form.The posterior KL upper-bounds the predictive KL and is therefore used as the loss.
  • 3.2 Approximate Bayesian Unlearning: Minimizing EUBO is equivalent to minimizing KL[qu(θ|Dr) ∥ p(θ|Dr)], while retraining with Dr maximizes the corresponding ELBO.EUBO differs from ELBO in optimization direction and is tied to the posterior objective through Proposition 2.
  • 3.2 Approximate Bayesian Unlearning: EUBO trades off fully forgetting De against retaining information from the full-data posterior p(θ|D), naturally regularizing against catastrophic unlearning.The retention term is described as preventing performance degradation relative to retraining with remaining data.
  • 3.3 Approximate Bayesian Unlearning with Approximate Posterior Belief: When only q(θ|D) is available, the methods estimate the remaining-data target as ˜p(θ|Dr) ∝ q(θ|D)/p(De|θ) and minimize divergence to it.This substitution introduces additional difficulty because the exact full-data posterior and its discrepancy from q(θ|D) are unknown.
  • 3.3.1 EUBO with Adjusted Likelihood: The adjusted-likelihood trick suppresses unlearning where q(θ|D) is small, whereas reverse KL naturally protects those regions and remains closer to q(θ|Dr) as λ approaches 0.EUBO with very small λ can underestimate variance and suffer catastrophic unlearning; reverse KL is less sensitive to small λ.

4 Experiments and Discussion

Experiments evaluate EUBO and reverse-KL unlearning across Bayesian classifiers and sparse GP models, varying erased-data structure, posterior representation, and λ. Reverse KL is often effective without adjusted likelihood, while EUBO depends more strongly on λ and posterior flexibility.

  • 4.1 Sparse Gaussian Process (GP) Classification with Synthetic Moon Dataset: Synthetic-moon experiments compare predictive distributions and averaged KL divergence over remaining and erased data for EUBO, rKL, and the full-data baseline.The evaluation varies λ and examines both retained and erased regions.
  • 4.1 Sparse Gaussian Process (GP) Classification with Synthetic Moon Dataset: At λ = 10^-9, EUBO achieves lower averaged KL divergence than the full-data baseline, whereas λ = 0 causes poor performance and catastrophic unlearning.The failure appears mainly in the input region containing erased data.
  • 4.1 Sparse Gaussian Process (GP) Classification with Synthetic Moon Dataset: At λ = 0, rKL achieves much smaller KL divergence than the full-data baseline without requiring the adjusted likelihood.This behavior is consistent with the method’s intended robustness to low λ.
  • 4.2 Logistic Regression with Banknote Authentication Dataset: On banknote authentication, randomly erased data yields a baseline averaged KL divergence of about 10^-3, while Gaussian posterior models make EUBO ineffective at small λ.rKL remains close to the full-data baseline, and both methods unlearn well when normalizing flows represent the posterior.
  • 4.3 Logistic Regression with Fashion MNIST Dataset: On fashion MNIST, the baseline averaged KL divergence is about 0.1 despite erasing 10000 examples, and λ = 0 improves rKL while EUBO deteriorates.The experiment models 650 weights as random variables while holding the remaining network weights fixed.
  • 4.4 Sparse Gaussian Process (GP) Regression with Airline Dataset: The airline experiment demonstrates scalable unlearning on approximately 2 million flights, using stochastic VI and mini-batches of erased data for EUBO.The erased set contains 100K examples, and the sparse GP uses 50 inducing inputs.

5 Conclusion

The paper develops approximate Bayesian unlearning methods that use an approximate full-data posterior and erased data, then evaluates them on sparse GP and logistic regression models. The methods, especially reverse KL without adjusted likelihood, can effectively unlearn while retaining practical parsimony.

  • 5 Conclusion: The proposed methods approximately unlearn Bayesian models from erased data using only the approximate full-data posterior and the erased data.They address inaccuracies in the VI posterior with adjusted likelihood and reverse-KL techniques.
  • 5 Conclusion: The adjusted-likelihood and reverse-KL tricks curb unlearning where the approximate posterior assigns low belief, targeting both identified VI inaccuracies.These mechanisms are designed to avoid excessive deviation during direct unlearning.
  • 5 Conclusion: Empirical evaluations show that the proposed methods, especially reverse KL without adjusted likelihood, can effectively unlearn sparse GP and logistic regression models.The evaluations use synthetic and real-world datasets.
  • 5 Conclusion: Recovered approximate posteriors can be used immediately in ML applications and further improved by retraining on remaining data, at the expense of parsimony.This practical continuation is stated as a consequence of the proposed unlearning setup.

Broader Impact

Machine unlearning can support personal data ownership and faster recovery from detected data poisoning, but it may also create new opportunities for adversarial data sharing.

  • Unlearning can reduce the trace of users’ data in ML models, supporting personal data ownership under the GDPR.
  • Unlearning detected malicious data may recover service quality faster than retraining from scratch, reducing disruption costs.
  • An unethical collaborator could share low-quality data, later unlearn it, and continue training with higher-quality data to gain an advantage.
  • Data-sharing frameworks should account for the possibility that participants can unlearn previously shared datasets.

A Proof of Proposition 1

The proof establishes its inequality by applying convexity through the log-sum inequality and Jensen’s inequality, then integrating the resulting relation over observations.

  • The proof begins by following the log-sum inequality.
  • Convexity of f(t) = t log t supplies the function used in the proof.
  • Jensen’s inequality provides the key inequality in the argument.
  • The proof integrates both sides of the established inequality with respect to y.

B Proof of Proposition 2

Nonnegativity of a KL divergence makes U an upper bound on the log evidence of the erased data conditioned on the remaining data.

  • KL[qu(θ|Dr) ∥ p(θ|Dr)] ≥ 0 establishes that U upper-bounds log p(De|Dr).

C Bayesian Linear Regression

The Bayesian linear regression experiment compares direct unlearning with retraining using predictive distributions and KL divergence, including a bimodal-posterior case. EUBO and rKL can approximate the remaining-data posterior, while EUBO is vulnerable to catastrophic unlearning at λ = 0 in the synthetic regression experiment.

  • Bayesian Linear Regression: The experiment uses cubic Bayesian linear regression with parameters a = 2, b = −3, c = 1, and d = 0, plus Gaussian noise.
  • Bayesian Linear Regression: The erased data are clustered and informative, producing a large difference between predictive distributions trained on full versus remaining data.
  • Bayesian Linear Regression: Table 2 reports KL divergences for EUBO and rKL across varying λ on the synthetic linear regression dataset.
  • Bayesian Linear Regression: At λ = 0, EUBO suffers catastrophic unlearning, whereas rKL does not; with λ = 0.1 and 0.5, both improve over the no-unlearning baseline of 0.1170.
  • Bimodal Posterior Belief: The bimodal-posterior setup assumes a Gaussian-mixture full-data posterior and selects an erased-data likelihood yielding a Gaussian remaining-data posterior.
  • Bayesian Linear Regression: Figure 7 compares full-data VI, remaining-data retraining, and EUBO or rKL predictive samples under varying λ.
  • Bimodal Posterior Belief: In the bimodal case, λ = 0 produces approximate posteriors close to p(θ|Dr) = φ(θ; 0, 1) for both EUBO and rKL.

E Gaussian Process (GP) Classification with Synthetic Moon Dataset: Additional Details and Experimental Results

The synthetic-moon experiment uses a sparse GP classifier whose posterior over inducing variables yields Gaussian latent-function beliefs. EUBO and reverse KL are compared with VI retraining as the unlearning reference.

  • Model: The classifier models the blue-class probability from a latent GP function f_x, with 20 inducing inputs defining the sparse approximation.The inducing inputs are fixed for both training and unlearning.
  • Model: The approximate posterior q(f_x|D) is Gaussian because the inducing-variable posterior q(f_Xu|D) is multivariate Gaussian.Its mean and variance are derived from the conditional GP distribution and q(f_Xu|D).
  • Reference: VI retraining on the remaining data produces q(f_x|D_r) analogously, using the inducing-variable posterior learned from D_r.
  • Unlearning evaluation: EUBO and reverse KL induce approximate posterior beliefs whose predictive distributions are evaluated against the retrained model across λ values.Figures 9 and 10 visualize the latent-function beliefs, while the corresponding predictive distributions appear in the main experiment.
  • Results: At λ = 10^-9, EUBO produces a latent-function posterior similar to the VI-retrained q(f_x|D_r), whereas λ = 0 gives a different posterior.
  • Results: Reverse KL produces latent-function posteriors similar to q(f_x|D_r) at both λ = 10^-9 and λ = 0.

F A Note on Erasing Informative Data

The informative-data experiment varies how much erased data changes the posterior, measured by an entropy-reduction quantity I. As informativeness increases, the full-data baseline diverges more from retraining, and reverse KL is generally more robust than EUBO at λ = 0.

  • Experimental design: I measures how much erased data reduces the entropy of the inducing variables conditioned on remaining data, rather than mutual information with erased outputs.The chosen measure avoids an expensive expectation term because erased outputs are already known.
  • Experimental design: The four scenarios increase in I from randomly selected erased data to fully yellow erased data, where the latter most reduces posterior entropy.The scenarios use I values 0.27, 1.59, 2.06, and 3.86, respectively.
  • Results: As I increases, the predictive-distribution difference between full-data and remaining-data posteriors generally increases.
  • Results: For randomly selected erased data, the full-data baseline reaches averaged KL divergences of about 0.002 and 0.004, while both unlearning methods remain effective even at λ = 0.
  • Results: For partially and largely yellow erased data, EUBO performs poorly at λ = 0, whereas reverse KL achieves much smaller averaged KL divergence than the full-data baseline.
  • Results: For fully yellow erased data, both methods are closer to retraining than the full-data baseline by averaged KL, but reverse KL remains usable at λ = 0 while EUBO is useless.
  • Conclusion: The methods perform well when the remaining-versus-full approximate posteriors differ sufficiently little, but informative erased data exposes their limitation when only q(θ|D) is available.

G Logistic Regression with Fashion MNIST Dataset: Additional Experimental Results

The fashion-MNIST experiments compare EUBO and reverse KL under diagonal versus full-covariance Gaussian posterior approximations. Full covariance lowers baseline divergences and improves the relative unlearning performance of both methods.

  • Experimental setup: The additional experiments compare independent-Gaussian and multivariate-Gaussian posterior approximations for the fashion-MNIST unlearning task.The comparison is reported alongside class-probability visualizations at λ = 0.
  • Experimental setup: The class-probability figures compare q(θ|D), q(θ|D_r), and optimized reverse-KL and EUBO posteriors for images in D_r.The table caption likewise compares predictive distributions across the four erased-data scenarios.
  • Results: Reverse KL induces the highest class probability for the same class as q(θ|D_r) in most displayed cases.
  • Results: At λ = 0, optimized reverse-KL class probabilities can resemble q(θ|D), although the correct-class probability is reduced by unlearning.
  • Results: Using full covariance matrices decreases the averaged KL divergence of the full-data baseline compared with independent Gaussians.
  • Results: With full covariance matrices, both EUBO and reverse KL improve because their averaged KL divergences are not as large relative to the baselines.
Loading 2010.12883v1…