PaperlayerView exact revision on arXiv

Source-linked AI summary

Fast Yet Effective Machine Unlearning

Ayush K Tarun, Vikram S Chundawat, Murari Mandal, Mohan Kankanhalli

arXiv:2111.08947v5cs.LG

TL;DR

The paper asks whether classes can be removed from an already trained deep model without accessing the forgotten data, and whether this can be done quickly across large, varied networks. It proposes error-maximizing noise with impair-repair weight updates and reports effective, scalable unlearning, while noting an accuracy trade-off and scope limits for random-sample deletion.

  • Problem

    The paper addresses zero-glance unlearning: removing one or more classes from an already trained model when the forgotten data are unavailable, a setting motivated by privacy deletion requests.

  • Method

    UNSIR learns class-specific error-maximizing noise and uses single-pass impair and repair updates with retain data to manipulate the trained network.

  • Results

    The method supports efficient single- and multi-class unlearning across CNNs and Vision Transformers, with multiple classes requiring a similar number of update steps as one class.

  • Takeaways & Limitations

    UNSIR provides a post-training unlearning approach applicable to deep networks without constraints on the original optimization mechanism or network design.

  • Takeaways & Limitations

    Random-cohort and subset-of-class unlearning, adaptive adversaries, and stronger accuracy relative to retraining remain outside or constrained by the reported setting.

Abstract

from arXiv · show

Unlearning the data observed during the training of a machine learning (ML) model is an important task that can play a pivotal role in fortifying the privacy and security of ML-based applications. This paper raises the following questions: (i) can we unlearn a single or multiple class(es) of data from a ML model without looking at the full training data even once? (ii) can we make the process of unlearning fast and scalable to large datasets, and generalize it to different deep networks? We introduce a novel machine unlearning framework with error-maximizing noise generation and impair-repair based weight manipulation that offers an efficient solution to the above questions. An error-maximizing noise matrix is learned for the class to be unlearned using the original model. The noise matrix is used to manipulate the model weights to unlearn the targeted class of data. We introduce impair and repair steps for a controlled manipulation of the network weights. In the impair step, the noise matrix along with a very high learning rate is used to induce sharp unlearning in the model. Thereafter, the repair step is used to regain the overall performance. With very few update steps, we show excellent unlearning while substantially retaining the overall model accuracy. Unlearning multiple classes requires a similar number of update steps as for a single class, making our approach scalable to large problems. Our method is quite efficient in comparison to the existing methods, works for multi-class unlearning, does not put any constraints on the original optimization mechanism or network design, and works well in both small and large-scale vision tasks. This work is an important step towards fast and easy implementation of unlearning in deep networks. Source code: https://github.com/vikram2000b/Fast-Machine-Unlearning

I. INTRODUCTION

The introduction frames zero-glance machine unlearning as removing one or more classes from an already trained model without access to the forgotten data. It presents UNSIR as an efficient, multi-class method for deep networks.

  • Motivation: Zero-glance unlearning removes information about requested classes from an already trained model without accessing the forgotten samples.The setting is motivated by deletion requests for sensitive data such as facial images.
  • Research gap: Existing unlearning methods mainly target simple algorithms, while efficient unlearning for deep networks and multiple classes remains open.Deep networks add non-convex optimization and ambiguity in evaluating whether information has been removed.
  • Approach: UNSIR learns error-maximizing noise for forgotten classes and uses impair-repair updates to forget those classes while retaining other tasks.The impair step damages forget-class information, while repair stabilizes weights for retained classes.
  • Contributions: The method performs multi-class unlearning in a single impair-repair pass rather than sequentially unlearning individual classes.The authors position this as an efficiency advantage alongside the zero-glance privacy setting.
  • Contributions: The framework is designed for large-scale vision datasets and different deep-network types, including convolutional networks and Vision Transformers.It does not require prior information about the original model-training process.

II. RELATED WORK

Related work spans certified or approximate forgetting for simpler and deep models, but prior approaches can impose storage, retraining, convexity, or scale limitations. Privacy-preserving settings commonly assume access to training data or address unauthorized model use rather than post-training deletion.

  • Classical and certified methods: Prior data-forgetting methods include random forests, k-means, convex-learning certification, and grouped-training approaches.These approaches differ in whether they support minimal retraining, certified removal, or reduced data influence.
  • Training-time approaches: Strategic grouping methods require storing multiple network snapshots and gradients, creating substantial memory overhead.They may also retrain a subset of models to support later deletion requests.
  • Deep-network forgetting: Deep-network forgetting is difficult because non-convex loss functions complicate estimating how samples affect parameters.Approximation accuracy and computational costs can degrade on larger datasets.
  • Privacy settings: Common privacy-preserving frameworks assume the model can access the entire training dataset and focus on preventing information leakage.Other settings seek to make personal data unusable for unauthorized deep-learning models.

III. UNLEARNING IN ZERO-GLANCE PRIVACY SETTING

The zero-glance setting addresses deletion requests when forgotten data are unavailable, using only the trained model and a subset of retained data. The framework learns class-specific noise, then applies impair and repair updates.

  • Setting: Privacy regulations and practical time constraints can require immediate deletion from an already trained model when the forget data cannot be reused.The remaining data are therefore used for the unlearning procedure.
  • Objective: The complete dataset is partitioned into disjoint forget and retain sets, and the objective is to produce weights that behave as if the forget set had not been seen.The updated model is constructed from the trained model and a retain subset that contains no forget-set information.
  • Framework: For each forgotten class, the method learns a noise matrix from the trained model and transforms the model to fail on forget samples while preserving retain accuracy.Only a small subset of retain samples is used to support this transformation.
  • Framework: Figure 1 orders the process as error-maximizing noise learning, one-epoch impair updating with retain data plus noise, and repair updating with retain data alone.Repair is intended to regain overall performance while unlearning the requested classes.

IV. ERROR-MAXIMIZING NOISE BASED UNLEARNING

UNSIR creates class-specific error-maximizing noise and uses it to manipulate network weights through controlled impair and repair stages. The design targets rapid forgetting while preserving performance on retained classes.

  • Error-maximizing noise: Error-maximizing noise is learned by increasing the model loss for the class to be unlearned, producing anti-samples that target its learned information.The noise is intended to have high influence on parameter updates for the relevant classes.
  • Error-maximizing noise: The noise optimization uses the trained model with frozen weights and constrains noise magnitude through an Lp-norm penalty.The paper uses cross-entropy loss with L2 normalization and λ to regulate the trade-off.
  • Multi-class unlearning: For multiple forgotten classes, UNSIR learns a separate noise matrix for each class but executes one common impair-repair pass.The authors state that the optimization can be performed in an insignificant amount of time.
  • Impair and repair: The impair stage trains for one epoch on retain samples combined with generated noise, using a high learning rate to corrupt forget-class weights.The repair stage then trains for one epoch on retain data alone to recover retained-class performance.

V. EXPERIMENTS AND RESULTS

The experiments evaluate unlearning across multiple datasets, architectures, and metrics, including retained and forget-set accuracy, relearn time, weight distance, and prediction distributions. The method is tested in varied vision settings and compared with retraining and other baselines.

  • Evaluation scope: The evaluation spans ResNet18, AllCNN, MobileNetv2, and Vision Transformers across CIFAR-10, CIFAR-100, and VGGFace-100.Experiments include models trained from scratch and pretrained models fine-tuned on target datasets.
  • Overall outcome: The study reports broad applicability across the tested networks and datasets.The supplied results passage summarizes wide applicability without providing a consolidated numerical comparison across all settings.
  • Evaluation metrics: Forget-set accuracy should approach zero, while retain-set accuracy should remain near the original model’s performance.Relearn time, weight distance, and prediction distributions provide additional evidence about residual forget-class information.
  • Prediction analysis: Prediction distributions are examined for repeated predictions on forget-class samples, which could indicate information exposure or vulnerability to adversarial attacks.Similarity between the proposed and retrained-model distributions is used as an additional robustness signal.

B. Models

The models section covers unlearning experiments on CIFAR-10, CIFAR-100, and VGGFace-100, using several class-removal settings and comparisons with established baselines. The comparisons include retraining, fine-tuning, negative-gradient updates, and Fisher Forgetting.

  • CIFAR-10: CIFAR-10 experiments unlearn one, two, four, or seven classes from ResNet18 and AllCNN models trained from scratch.The selected class subsets include class 0 for single-class unlearning and manually selected subsets for multi-class unlearning.
  • Baseline comparison: Fisher Forgetting achieves forgetting on CIFAR-10 but fails to maintain accuracy on the retained dataset.This comparison motivates assessing both removal of forget-class information and preservation of retained-task performance.
  • Transfer-learning models: CIFAR-100 and VGGFace-100 tables report experiments using models pretrained on ImageNet and fine-tuned for the target datasets.The supplied captions identify the datasets and transfer-learning setup without giving table values.
  • Baselines: The study compares the proposed method with retraining, fine-tuning on retained data, and negative-gradient updates.Fisher Forgetting is additionally evaluated for single-class forgetting, while later CIFAR-10 comparisons use retraining because other baselines perform poorly.

D. Experimental Settings

The experiments use a single-shot impair-and-repair setup with dataset-specific noise and learning-rate configurations. Reported results show substantial forget-set degradation, retained accuracy, and longer relearn time than baselines.

  • Experimental settings: The experiments run on a NVIDIA Tesla-V100 GPU with dataset-specific settings for CIFAR-10, CIFAR-100, and VGGFace-100.The supplied settings describe noise copies, retained-set sizes, and learning rates for impair and repair.
  • Baselines: The comparisons include Retrain Model, FineTune, and NegGrad, with Fisher Forgetting additionally used for single-class comparison.Because FineTune, NegGrad, and Fisher Forgetting perform poorly on CIFAR-10, later experiments compare only with the retrained model.
  • Single-shot results: 71.06% retained-set accuracy remains from an initial 77.86%, while forget-set accuracy falls to 0% from an initial 81.01% for ResNet18 on CIFAR-10.These values are reported for the proposed method after a single shot of impair and repair.
  • Prediction behavior: The method gives randomized responses on forget-class queries, while its AllCNN prediction distribution is similar to that of the retrained model.These analyses assess whether forget-class inputs reveal repeated prediction patterns or residual information.
  • Relearn robustness: >100 versus 12 and 18 relearn-time epochs is reported for the method versus baseline methods on AllCNN and CIFAR-10.The higher relearn time is presented as evidence of more robust erasure of forget-class information.

2) Multiple Class Unlearning:

The method maintains strong retain-set performance while unlearning multiple classes across image-classification and face-recognition settings. Its predictions and layer-wise weight changes are comparable to retraining, while GradCAM indicates loss of focus on forgotten classes.

  • After unlearning 20 CIFAR-100 classes, the method retains 75.38% accuracy versus 77.88% initially on the retain set.
  • For 4-class CIFAR-10 unlearning, the method preserves 0% forget-set accuracy and 80.21% retain-set accuracy.
  • On VGGFace-100, 1-class unlearning retains 72.29% accuracy versus 80.63% initially and reduces forget-set accuracy to 3%.
  • For 60-class forgetting with pretrained ViT, retain-set accuracy is 87.82% versus 90.97% initially, while forget-set accuracy is 8.48% versus 91.82% initially.
  • The unlearned model has prediction outputs similar to the retrained model, supporting robustness across single- and multi-class settings.
  • Our method produces weight distances comparable to or higher than retraining, while GradCAM shows reduced focus on forgotten-class regions.

VI. ANALYSIS

The analysis examines whether unlearning changes the network comparably to retraining, removes forgotten-class representations, and reduces computational cost. Across these diagnostics, the proposed method shows retraining-like weight changes, loss of relevant forgotten-class focus, and substantially faster execution.

  • The proposed method’s layer-wise weight differences follow a trend similar to the retrained model for AllCNN and ResNet18.Lower distance can indicate ineffective unlearning, while much higher distance may indicate a Streisand effect and possible information leaks.
  • After unlearning, ResNet18 cannot focus on relevant regions of forgotten-class images, indicating that related information is no longer contained in the network weights.
  • Less than 4 seconds of computation makes the method 154× faster than retraining and 1875× faster than Fisher forgetting.The method uses 1.1 seconds for noise optimization, 1.70 seconds for impair, and 1.13 seconds for repair on ResNet18+CIFAR-10.

D. Comparing Different Impair-Repair Configurations

The impair-repair analysis shows that forgetting is driven mainly by impair steps, while repair restores retain performance. Two impair-repair cycles achieve the target forget-set result with limited retain-set degradation, and the broader method trades some accuracy for speed.

  • A single impair-repair cycle does not reach 0% forget-set accuracy; two impair steps reach 0% before repair, which restores accuracy to 3%.
  • Two impair-repair cycles achieve 0% forget-set accuracy with retain-set performance of 72.79%, 72.5%, and 70.86% across the reported configurations.
  • The method performs unlearning on already trained deep models without requiring a specific training procedure or convex optimization assumptions.
  • The method’s 154× and 1875× efficiency gains over retraining and Fisher forgetting come at the cost of decreased accuracy relative to retraining.
  • The conclusion reports scalable multi-class unlearning across CNNs and Vision Transformers, with applicability to models trained using any optimization method.

APPENDIX

The appendix analyzes learning rates, weight penalization, and retain-data availability as controls on unlearning and retained performance. Results indicate that repair and penalization choices affect the balance between forgetting and retention, while more retain data yields slightly better unlearning.

  • The impair learning rate affects unlearning outcomes, while repair recovers performance on retain classes.The appendix varies impair learning rates with repair fixed at 0.01 and separately varies repair rates with impair fixed at 0.02.
  • With λ = 0, ResNet18 reaches 0% accuracy on Df but only 67.03 accuracy on Dr, showing poorer retain-set performance without penalization.
  • Using some λ penalization generally improves expected performance on both forget and retain sets for AllCNN and ResNet18.
  • More available retain data produces slightly better unlearning results.

D. Sequential Forgetting

The method supports sequential class-unlearning requests with limited performance deterioration, while repair steps trade additional computation for improved retain-set accuracy. Its effective unlearned models need not be close to the retrained model in parameter space.

  • Sequential requests: Three sequential unlearning requests in CIFAR-10 with AllCNN caused little performance deterioration.The requests sequentially forget class-0, class-1, and class-2.
  • Repair-step trade-off: Multiple repair steps can further improve Dr accuracy beyond the single-step repair.Most performance gain comes from one repair step, but two or three steps can improve performance further.
  • Repair-step trade-off: The number of repair steps trades computational cost against performance on Dr.
  • Parameter-space analysis: The proposed unlearned model performs well on readout functions despite being far from the retrained gold-standard model in parameter space.This suggests effective unlearning does not require moving network weights toward the retrained model.
Loading 2111.08947v5…