PaperlayerView exact revision on arXiv

Source-linked AI summary

Zero-Shot Machine Unlearning

Vikram S Chundawat, Ayush K Tarun, Murari Mandal, Mohan Kankanhalli

arXiv:2201.05629v3cs.LGcs.AI

TL;DR

The paper addresses machine unlearning when no original training samples are available, a setting motivated by privacy requirements and practical data-access constraints. It proposes noise-based and gated knowledge-transfer methods, reporting promising benchmark vision results and privacy-attack protection, while noting limitations for very large models and non-class-level requests.

  • Problem

    Zero-shot unlearning addresses the gap that existing methods require original data or training information, although deletion requests may arise when such resources are unavailable.

  • Method

    The paper proposes error-maximizing and error-minimizing noise and gated knowledge transfer for data-free unlearning.

  • Results

    The experiments report promising zero-shot unlearning results on benchmark vision datasets, with protection evaluated against model inversion and membership inference attacks.

  • Takeaways & Limitations

    Zero-shot unlearning offers a framework for class-level data deletion from deep-learning models without access to original training samples.

  • Takeaways & Limitations

    The methods are less effective for very large models and currently support class-level, rather than random-cohort or subclass, unlearning.

Abstract

from arXiv · show

Modern privacy regulations grant citizens the right to be forgotten by products, services and companies. In case of machine learning (ML) applications, this necessitates deletion of data not only from storage archives but also from ML models. Due to an increasing need for regulatory compliance required for ML applications, machine unlearning is becoming an emerging research problem. The right to be forgotten requests come in the form of removal of a certain set or class of data from the already trained ML model. Practical considerations preclude retraining of the model from scratch after discarding the deleted data. The few existing studies use either the whole training data, or a subset of training data, or some metadata stored during training to update the model weights for unlearning. However, in many cases, no data related to the training process or training samples may be accessible for the unlearning purpose. We therefore ask the question: is it possible to achieve unlearning with zero training samples? In this paper, we introduce the novel problem of zero-shot machine unlearning that caters for the extreme but practical scenario where zero original data samples are available for use. We then propose two novel solutions for zero-shot machine unlearning based on (a) error minimizing-maximizing noise and (b) gated knowledge transfer. These methods remove the information of the forget data from the model while maintaining the model efficacy on the retain data. The zero-shot approach offers good protection against the model inversion attacks and membership inference attacks. We introduce a new evaluation metric, Anamnesis Index (AIN) to effectively measure the quality of the unlearning method. The experiments show promising results for unlearning in deep learning models on benchmark vision data-sets. The source code is available here: https://github.com/ayu987/zero-shot-unlearning

I. INTRODUCTION

The paper frames zero-shot machine unlearning as deleting information from trained models when original training data are unavailable, motivated by privacy obligations and practical access constraints. It proposes two data-free methods, a new evaluation metric, and evaluation on benchmark vision datasets.

  • Privacy regulations and deletion requests require removing data and information derived from it from machine-learning models.
  • Existing unlearning methods often depend on original training data, subsets of it, or training metadata that may be unavailable, costly, or impractical to retain.
  • Zero-shot machine unlearning imposes the constraint that unlearning algorithms access zero training data, more closely matching practical deletion scenarios.
  • The paper proposes data-free unlearning using error-maximizing and error-minimizing noise or gated knowledge transfer in a teacher-student framework.
  • The authors introduce the Anamnesis Index and evaluate unlearned models using retain performance, forget performance, and privacy attacks.

II. RELATED WORK

Prior machine-unlearning approaches trade efficiency, effectiveness, or assumptions about accessible data and training information. The paper targets deep-learning models in a stricter data-free setting because existing methods generally require data or stored training metadata.

  • Exact unlearning retrains models from scratch without forget data, making it computationally expensive for deep-learning models.
  • The paper’s zero-shot methods require neither training data nor prior training-process information and do not train an additional network.
  • Stored per-step training information creates memory-overhead concerns and a trade-off between computational efficiency and storage.
  • Existing approximate methods use forget data, remaining data, or training metadata such as loss gradients and weight updates.
  • Machine unlearning may target entire classes or particular samples, while the paper focuses on class-level forgetting.

IV. ZERO-SHOT MACHINE UNLEARNING

The paper formalizes zero-shot unlearning as producing an unlearned model from the trained model’s parameters and forget-class query, without access to retain or forget samples. The target behavior is similarity to a model trained only on retain data.

  • The section formalizes zero-shot unlearning and presents two approaches plus a metric for assessing the degree of unlearning.
  • The model M(x; θ) outputs class probabilities, with θ representing the parameters obtained by training algorithm A on dataset D.
  • A retain-only model Mr is defined as a model that has observed data corresponding only to the retain classes.
  • A zero-shot method accesses neither retain data Dr nor forget data Df, using only trained parameters θ and the forget-class query Cf.
  • The resulting model Mu is expected to behave similarly to the retrained model Mr, although its parameters need not equal θr.

B. Error Minimization-Maximization Noise

The section develops data-free noise generation for zero-shot unlearning, using error-minimizing noise to proxy retain samples and error-maximizing noise for forget classes. It then motivates gated knowledge transfer because the noise approach can yield substandard unlearning.

  • Error Minimization-Maximization Noise: Error-maximizing noise acts as anti-samples for forget classes, while error-minimizing noise synthesizes proxies for unavailable retain samples.The retain-class noise minimizes model loss, reflecting the expected loss of original retain samples.
  • Error Minimization-Maximization Noise: The noise matrices are generated for every retain class and used to update the trained model without access to retain data.The method generates input-sized noise for each retain class and updates it using classification loss.
  • Error Minimization-Maximization Noise: The method uses multiple impairment iterations rather than a single shot, and omits the repair step because it did not improve retain-set accuracy in the data-free setting.The overall procedure is depicted in Figure 1.
  • Gated Knowledge Transfer: Gated knowledge transfer assigns the original model as teacher and a same-architecture random model as student, filtering forget-class information before student updates.A generator produces pseudo-data, while the student minimizes divergence and attention loss; generator and student updates alternate.
  • Gated Knowledge Transfer: The band-pass filter attenuates forget-class information and passes only retain-class information to the student.It filters generated pseudo-samples according to teacher-predicted probabilities for forget classes, using threshold ϵ.

D. Anamnesis Index

The Anamnesis Index addresses limitations of relearn time by measuring how quickly an unlearned model or scratch-retrained model returns near the original forget-class accuracy. Values near 1 indicate better unlearning, while deviations can signal residual information or detectable parameter changes.

  • Metric motivation: Relearn time can be misleading because an unlearned model may regain accuracy quickly without converging to the original forget-class accuracy.The metric therefore uses a margin around original accuracy rather than only the epoch at which that accuracy is reached.
  • Definition: AIN is defined as the relearn time of the unlearned model divided by that of a model trained from scratch on retain data.The relearn-time function counts mini-batches needed to come within α% of the original model’s forget-class accuracy.
  • Interpretation: AIN ranges from 0 to ∞, with values closer to 1 indicating better unlearning.Values much lower than 1 suggest retained forget-class information, whereas values much higher than 1 may indicate detectable over-editing.
  • Parameter choice: The suggested α value is 5-10%, balancing misleadingly broad margins against instability from very narrow margins.A high α can produce scores near 1, while a much lower α can make results unstable.

1) Setting the value of

The evaluation uses forget-set and retain-set accuracy, Anamnesis Index, and privacy attacks across benchmark datasets and CNN architectures. Experiments cover single- and multi-class zero-shot unlearning without using training data during unlearning.

  • Experiments evaluate single- and multi-class zero-shot unlearning with AllCNN, LeNet, and ResNet9 on MNIST, CIFAR-10, and SVHN.
  • The evaluation uses training and testing sets for assessment, although these data are not used by the zero-shot unlearning methods.
  • Forget-set accuracy should approach the retrained model, while retain-set accuracy should remain close to the original model.
  • Anamnesis Index should be close to 1, using relearning time to assess how much forget-set information remains recoverable.
  • Model inversion should reveal no information about the forget class, and membership-inference probability should be lower than for the original model.

C. Results and Analysis

GKT substantially outperforms the Min-Max baseline by preserving retain-set accuracy while driving forget-set accuracy toward zero. However, the proposed methods do not fully preserve original retain-set performance, and results are less consistent on LeNet and ResNet9.

  • Baseline results: 20.58% retain accuracy versus 84.05% for the original model shows the Min-Max method damages retained performance on AllCNN+CIFAR-10.
  • Baseline results: 5.11% forget-set accuracy in the same Min-Max experiment indicates incomplete forgetting despite the severe retain-set degradation.
  • GKT versus Min-Max: 96.87% retain accuracy versus 98.17% for the original model is achieved by GKT in two-class AllCNN+MNIST unlearning, with 0% forget-set accuracy.
  • GKT versus Min-Max: GKT obtains 0% forget-set accuracy across LeNet and ResNet9 datasets, while Min-Max damages both retain and forget performance.
  • Limitations: Retain-set accuracy is not fully preserved, and LeNet and ResNet9 results are less consistent than AllCNN results in the zero-shot setting.

3) Comparison with the state-of-the-art unlearning methods:

The paper positions zero-shot unlearning as distinct from methods requiring training data and analyzes GKT’s knowledge-transfer dynamics and privacy robustness. Its figures emphasize the retain–forget accuracy trade-off and the need to stop training at the appropriate point.

  • Comparison with existing methods: Unlike existing state-of-the-art methods, the proposed zero-shot method requires no access to training data for unlearning.
  • Comparison with existing methods: The method trails a non-zero-shot comparator by 1.5% on retain-set accuracy while forgetting the forget set with equal effectiveness.
  • GKT progression: GKT’s generator maximizes the teacher–student information gap, while a band-pass filter rejects generated forget-set samples before student training.
  • GKT progression: After retain-set information is absorbed, retain accuracy stagnates and forget-set accuracy begins rising, making the stopping point important.
  • Privacy attacks: Model inversion is tested with white-box access to the current unlearned model, without access to previous model versions or class contents.
  • Privacy attacks: Inversion produces circle-like patterns for the fully trained model but completely random patterns for the retrained and GKT forget models.
  • Ablation: The filter threshold values 0.001 and 0.01 work well, while the default 0.01 threshold converges faster.

1) Band-Pass filter

The band-pass filter’s threshold controls whether information associated with forget data Df reaches the student. Thresholds above the random probability are ineffective, while loss-function changes can prevent effective student learning.

  • Band-Pass filter: A threshold of 0.5 produces the worst outcome, remaining unstable and far from the target performance.The generator crashes around epoch 1750 because no generated samples pass the filter afterward.
  • Band-Pass filter: Thresholds above the random probability 0.1 are ineffective at stopping information flow corresponding to Df.The tested thresholds are 0.5, 0.1, 0.01, and 0.001.
  • Ablation: Adding an attention-difference term to the generator loss makes it too easy to fool the student, so the student learns nothing.This ablation is shown in Fig. 8.
  • Ablation: Replacing KL-divergence with JS-divergence decreases effectiveness and again prevents the student from learning.The ablation compares the default loss with JS-divergence in both student and generator losses.
  • Conclusion: The proposed approaches target zero-shot unlearning while preserving retain-data efficacy and removing forget-data information.The paper evaluates privacy protection and introduces the Anamnesis Index for measuring unlearning quality.

APPENDIX

The appendix presents pseudocode for two zero-shot unlearning procedures: Noise Minimization-Maximization and Gated Knowledge Transfer. The noise method constructs synthetic class-specific inputs before applying the unlearning update.

  • Noise Minimization-Maximization: Algorithm 1 initializes separate forget-class and retain-class noise distributions before constructing the noise dataset.Forget classes are denoted Cf and retain classes Cr.
  • Noise Minimization-Maximization: Forget-class noise is optimized using a loss that reverses the model loss and includes an L2 penalty.The update uses gradient descent on the noise variables.
  • Noise Minimization-Maximization: Retain-class noise is separately initialized and optimized before being appended to the dataset.The resulting noise samples are combined across forget and retain classes.
  • Unlearning step: The constructed noise dataset is shuffled and used in batches for the model’s unlearning step.Each batch is passed through the model, and the model loss is computed from its predictions and labels.
  • Gated Knowledge Transfer: The appendix identifies Algorithm 2 as the Gated Knowledge Transfer procedure and references its generator architecture.The generator architecture is given in Table V.

B. Additional Ablation Study

Additional studies examine synthetic-data evaluation, loss ablations, individual-class and sequential unlearning, and membership-inference results. Synthetic progress tracks real-data progress, but repeated unlearning can eventually make retraining preferable.

  • Additional Ablation Study: Synthetic CIFAR-10 and SVHN test data show progression highly correlated with real-data progression during GKT unlearning.DeepInversion generates the synthetic test images, which can support stopping-criteria decisions.
  • Additional Ablation Study: Adding attention difference or replacing KL-divergence with JS-divergence prevents the student from learning effectively.The comparison is made against the default GKT experiment settings.
  • Additional Ablation Study: 0% forget-set performance matches the retrained model after individual-class unlearning, while retain-set differences range from 0.09% to 10.63%.The smallest reported difference is for class 4, and the largest is for class 5.
  • Additional Ablation Study: After the 6th or 7th sequential class unlearning in a 10-class model, retraining is preferable to further unlearning.The paper identifies a trade-off between unlearning cost and retraining cost.
  • Membership Inference Attack: The membership-inference analysis compares fully trained, retrained or gold, and GKT models across train, test, forget, and retain subsets.The table reports attack probabilities for these model and data combinations.

E. Membership Inference Attack

The membership-inference analysis focuses on leakage about whether particular data points were present in training. The proposed GKT method operates without observing data points, using informative pseudo-samples, while broader attack evaluation remains unresolved.

  • Membership Inference Attack: Membership inference threatens privacy by revealing whether an individual’s data was included in model training.The paper illustrates this risk using private medical-history information.
  • Membership Inference Attack: GKT obtains the unlearning model without observing data points, instead using generator-produced pseudo-samples with high information for the student.The most informative samples have high confidence on a few classes.
  • Membership Inference Attack: A uniformly applicable membership attack for comparing different unlearning methods is identified as requiring further investigation.This issue is stated as beyond the scope of the paper.
Loading 2201.05629v3…