PaperlayerView exact revision on arXiv

Source-linked AI summary

Learn to Unlearn: A Survey on Machine Unlearning

Youyang Qu, Xin Yuan, Ming Ding, Wei Ni, Thierry Rakotoarivelo, David Smith

arXiv:2305.07512v2cs.LGcs.AI

TL;DR

Privacy concerns and changing data needs motivate removing designated samples from trained models, but exact and approximate unlearning raise verification and security challenges. This survey reviews unlearning techniques, verification, and attacks, and reports experimental accuracy and cost patterns that vary with deletion conditions.

  • Problem

    Machine unlearning addresses the need to remove designated data from trained models amid privacy, system-update, and robustness concerns, while exact and approximate approaches raise verification and attack challenges.

    Source: §I · p. 1

  • Method

    The article surveys exact and approximate unlearning techniques, verification mechanisms, and attacks, and reports experiments on effectiveness and cost.

    Source: §I · pp. 1–2

  • Results

    Experiments report less than 0.1% testing-accuracy degradation for two models under IID deletion, over 8% Deltagrad accuracy degradation at 30% deletion in a non-IID setting, and Deltagrad time rising from 12.53s to 21.22s as scratch-retraining time falls from 42.19s to 29.15s.

    Source: 1) Evaluation of accuracy in an IID… · p. 8, 2) Evaluation of accuracy in a non-IID… · p. 8, 3) Evaluation of time consumption · p. 8

  • Takeaways & Limitations

    The survey frames verification of unlearning as important to process integrity and secure, ethical AI deployment in sensitive settings.

    Source: §I · p. 1

    Exact unlearning can deteriorate model performance, and discrepancies between original and retrained models may expose removals to inference attacks.

    Source: §III · p. 3

Abstract

from arXiv · show

Machine Learning (ML) models have been shown to potentially leak sensitive information, thus raising privacy concerns in ML-driven applications. This inspired recent research on removing the influence of specific data samples from a trained ML model. Such efficient removal would enable ML to comply with the "right to be forgotten" in many legislation, and could also address performance bottlenecks from low-quality or poisonous samples. In that context, machine unlearning methods have been proposed to erase the contributions of designated data samples on models, as an alternative to the often impracticable approach of retraining models from scratch. This article presents a comprehensive review of recent machine unlearning techniques, verification mechanisms, and potential attacks. We further highlight emerging challenges and prospective research directions (e.g. resilience and fairness concerns). We aim for this paper to provide valuable resources for integrating privacy, equity, andresilience into ML systems and help them "learn to unlearn".

I. INTRODUCTION

Machine unlearning offers an alternative to retraining models from scratch when designated data must be removed, including for privacy, resilience, bias reduction, or uncertainty quantification. The article surveys exact and approximate methods, verification, and attacks, and reports experiments on effectiveness and cost.

I. INTRODUCTION

  • Machine unlearning is proposed as an efficient alternative to retraining from scratch to remove designated samples, including when privacy, resilience, bias reduction, or uncertainty quantification calls for data removal.The article frames this as an alternative to entirely retraining the model.Source: §I · p. 1
  • The article identifies verification and attacks as central topics alongside its survey of existing machine-unlearning techniques.Its stated contributions include a taxonomy of exact and approximate methods and an examination of verification and relevant attacks.Source: §I · p. 1
  • Experiments provide insights into the effectiveness and cost of machine unlearning.The article presents experimental results as a contribution of the study.Source: §I · p. 1
  • The survey covers representative exact and approximate unlearning research from 2015–2022, alongside verification methods and relevant attacks.The selected papers span top-ranked peer-reviewed venues in the IEEE and ACM databases.Source: §I · pp. 1–2

II. FROM LEARNING TO UNLEARNING

The section motivates unlearning through privacy rights, recovery from poisoned data, and removal of low-quality samples. It describes unlearning as reversing selected data's influence and outlines algorithms and mechanisms intended to support the process.

A. Motivation

  • Privacy laws including the GDPR and California's CCPA recognize rights to erase or delete personal data, motivating model updates when data must be removed.The passage also notes that the Australian Privacy Act Review Report recommended adding a right to be forgotten.Source: A. Motivation · p. 2
  • Unlearning can remove maliciously injected poisoned samples and low-quality training data that may harm predictive behavior or degrade model performance.The article presents poison recovery as a cybersecurity motivation and low-quality data removal as a performance-optimization motivation.Source: A. Motivation · p. 2

B. Overview of Machine Unlearning

  • The overview casts unlearning as an inverse operation that aims to negate selected data's effect on a model.The section explains that processed data points modify model parameters.Source: B. Overview of Machine Unlearning · p. 2
  • Outlined approaches include removing data and retraining, adjusting weights, applying regularization, and reversing data-induced weight changes.Differential unlearning is described as understanding and reversing changes in model weights induced by particular data points.Source: B. Overview of Machine Unlearning · p. 2
  • Model versioning, data-sanitization layers, and checkpoints are described as mechanisms for reversion, filtering, or rollback during unlearning.Snapshots and periodic model states are presented as ways to avoid traversing all training data again.Source: B. Overview of Machine Unlearning · p. 2

III. EXACT MACHINE UNLEARNING

Exact unlearning aims to eliminate a designated data segment completely, generally requiring some retraining. The surveyed methods trade retraining efficiency against model performance, with privacy leakage also identified as a challenge.

III. EXACT MACHINE UNLEARNING

  • Exact unlearning generally requires retraining, and its main challenges are retraining efficiency and the retrained model’s performance.The survey also identifies performance deterioration and possible privacy leakage as concerns.Source: §III · pp. 2–3
  • SISA partitions data into isolated shards and slices, then resumes retraining from the affected slice and aggregates preserved parameters.Component-model performance may drop when datasets are too small or the learning task is intricate.Source: §III · p. 3
  • DeltaGrad maximizes loss on data designated for deletion and integrates the reversed model with a preserved original to expedite retraining.The cited account says performance can be sustained when the deletion proportion is constrained to 1%; it also notes no support for mini-batch sizes.Source: §III · p. 3
  • DaRE targets random forests and retrains 2 to 4 orders of magnitude faster than starting anew, with a minor performance reduction.Its application does not extend to other ML algorithms.Source: §III · p. 3
  • A discrepancy between the original and retrained models may let an adversary infer that a particular entity’s data was removed.The survey also says exact unlearning has focused largely on rapid retraining with minimal or no performance compromise.Source: §III · p. 3

IV. APPROXIMATE MACHINE UNLEARNING

Approximate unlearning methods seek to mask differences between models before and after removal while preserving performance. The survey describes varied approaches alongside challenges in verification, privacy, and fit with the right to be forgotten.

IV. APPROXIMATE MACHINE UNLEARNING

  • Certified removal uses a Newton step to remove a data point’s influence in L2-regularized linear models trained with differentiable convex loss.It adds random perturbations to the training loss, but requires Hessian inversion, does not support non-convex losses, and its data-dependent bound may misestimate the gradient residual norm.Source: §IV · p. 3
  • Golatkar et al. use a forgetting Lagrangian and scrubbing to erase information from trained DNN weights without original training data or full retraining.They provide a computable upper bound on residual information for DNNs; without assuming prior training, slight perturbations during crucial learning can substantially change the eventual solution.Source: §IV · pp. 3–4
  • Sekhari et al. distinguish differential privacy from machine unlearning and describe deletion algorithms that need no training-data access during deletion.Their approach lacks dimension-dependent information-theoretic lower bounds on deletion capacity and cannot handle non-convex losses.Source: §IV · p. 4
  • Nguyen et al. extend unlearning to variational Bayesian ML through prior and posterior knowledge, while Ginart et al. tailor methods to K-means and limit deletion to one record per iteration.The Bayesian approach is described as preserving performance but applying only to that ML subfield; the K-means work also proposes linearity, laziness, modularity, and quantization as design principles.Source: §IV · p. 4
  • Verification is nearly impossible from output observations alone, and because most approximate methods start from the model rather than the data, their fit with the right to be forgotten is questioned.The survey characterizes approximate unlearning as prioritizing performance preservation while adding privacy safeguards.Source: §IV · p. 4
  • A verification approach identifies pre-injected backdoors with acceptable efficiency and superior accuracy across multiple datasets, but faces constraints on samples and backdoor patterns.The survey also notes a risk of backdoor injection for attacks rather than verification.Source: §IV · p. 6
  • A reported member-inference attack breaches privacy for model-related unlearning but not data-related unlearning such as SISA; poisoning is also reported as a threat to certified unlearning.The poisoning strategy can evolve with the unlearning process.Source: §IV · p. 6

V. VERIFICATION AND ATTACKS OF UNLEARNING ALGORITHMS

The section reviews mechanisms for verifying data erasure and attacks on unlearning algorithms. Verification research is sparse, while membership-inference and poisoning attacks expose privacy risks and model-specific vulnerabilities.

V. VERIFICATION AND ATTACKS OF UNLEARNING ALGORITHMS

  • The survey found only one research contribution on mechanisms for systematically verifying data erasure, alongside a handful of contributions on attacks against machine unlearning,.Source: §V · p. 7
  • Sommer et al. verify deletion by checking a backdoor implanted in data before it is sent to the data user.Other strategies include data-sampling verification, synthetic-data verification, and bias analysis; limitations include sample restrictions, conflicting patterns, injection risks, and detection susceptibility.Source: §V · p. 7
  • Chen et al. use membership inference to test whether a sample was in the original training set, but success decreases with SISA or deletion above 0.2%.The attack reveals privacy risks associated with machine unlearning.Source: §V · p. 7
  • Marchant et al. formulate poisoning attacks across attacker knowledge, perturbation geometry, objective, computational time, and duration, but target certified-removal models and variants.Performance may deteriorate when standard anomaly-detection models are implemented.Source: §V · p. 7

VI. EVALUATION AND EXPERIMENTAL RESULTS

The paper identifies gaps in machine-unlearning literature and supplements its review with experiments. Its experiments use Deltagrad's reverse-learning approach, which amplifies the loss of excluded samples rather than minimizing it.

VI. EVALUATION AND EXPERIMENTAL RESULTS

  • The authors identify gaps and ambiguities in the developing machine-unlearning literature.They describe these gaps as leaving pressing questions unanswered.Source: §VI · p. 7
  • The survey combines a review of existing knowledge with experiments intended to provide tangible evidence of recent advances and practical insights.The authors state that the experiments address concepts they consider largely unexplored in contemporary discourse.Source: §VI · p. 7
  • The experiments use Deltagrad, which amplifies the loss of excluded samples instead of minimizing it.The paper identifies this as its reverse-learning approach.Source: §VI · p. 7

A. Experiment Design

The experiments examine how deletion proportion relates to accuracy in IID and non-IID settings and to time consumption. They extend the original Deltagrad implementation for non-IID deletion and per-class accuracy evaluation.

A. Experiment Design

  • The evaluation relates deletion proportion to model accuracy in IID and non-IID scenarios and to time consumption.The evaluation uses the original Deltagrad implementation, extended for non-IID deletion and per-class accuracy across datasets; reported results are means over 20 rounds with standard-deviation error bars.Source: A. Experiment Design · p. 7
  • The experiments extend the original Deltagrad implementation with non-IID deletion and per-class accuracy evaluation across datasets.The authors state these evaluations and results were not considered in the original Deltagrad article.Source: A. Experiment Design · p. 7
  • Results are means over 20 experimental rounds, with error bars showing standard deviations.The reported procedure evaluates deletion proportions against accuracy and time consumption.Source: A. Experiment Design · p. 7

B. Experiment Environments and Settings

The experiments use a two-layer neural network trained on MNIST, with specified optimization and unlearning hyperparameters. They evaluate accuracy in IID and non-IID settings across deletion ratios and compare baseline training, retraining, and Deltagrad.

B. Experiment Environments and Settings

  • Experiments use a two-layer, 300-hidden-unit ReLU network trained on MNIST's 60,000 training images and 10,000 test images.The setup uses a Windows machine with an Intel Xeon KVM CPU at 2.9 GHz and 16 GB memory, L2 regularization of 0.001, and deterministic gradient descent.Source: B. Experiment Environments and Settings · p. 7
  • The unlearning settings use T0 = 2 for the two-layer DNN, a first-quarter burn-in, and history size m = 2.The passage also reports T0 = 5 and j0 = 10 as general hyperparameter settings.Source: B. Experiment Environments and Settings · pp. 7–8

C. Experimental Results

1) Evaluation of accuracy in an IID setting

The evaluation compares accuracy under IID and non-IID deletion and measures deletion-time costs. Accuracy remains nearly unchanged with IID deletion, while non-IID deletion substantially degrades it; retraining and Deltagrad show opposing time trends.

1) Evaluation of accuracy in an IID setting

  • With IID deletion, testing accuracy stays consistent across all three models; the two unlearning models decline only from approximately 0.8735 to 0.8725.The reported decline is less than 0.1%.Source: 1) Evaluation of accuracy in an IID… · p. 8

2) Evaluation of accuracy in a non-IID setting

  • At a 30% deletion ratio, Deltagrad accuracy falls from 0.8735 to 0.7921, while label “9” accuracy rises from 82.9% to 88.3%.The non-IID deletion set contains 30% label “4” samples, with the remaining 70% distributed uniformly over the other nine labels.Source: 2) Evaluation of accuracy in a non-IID… · p. 8

3) Evaluation of time consumption

  • As deletion rises from 0.001 to 0.3, retraining time falls from 42.19s to 29.15s while Deltagrad time rises from 12.53s to 21.22s.The passage reports a crossover point and says the time trend is almost the same in the non-IID setting; Fig. 4 evaluates time consumption.Source: 3) Evaluation of time consumption · p. 8, Figure 4 · p. 8

A. Insights

The insights emphasize that deletion setting and data distribution shape unlearning’s accuracy and fairness consequences. The challenges section identifies non-IID risks and suggests directions for more adaptable methods and dynamic-model management.

A. Insights

  • In IID settings, negligible accuracy degradation relative to training from scratch makes computational complexity and other performance metrics relevant to method selection.Source: A. Insights · p. 9
  • Non-IID deletion can cause substantial performance loss and uneven class accuracy, with some labels degrading while others improve.Average accuracy may not reveal this class-level unfairness.Source: A. Insights · p. 9
  • Most current methods rely on maximizing quadratic loss with Newton’s method, while practical settings include other loss functions.Exploring alternatives may support more adaptable unlearning mechanisms.Source: A. Insights · p. 9

B. Challenges

  • Non-IID deletions can overrepresent classes and strip information about underrepresented classes, destabilize weights, and complicate optimization in sharp, non-convex loss regions.Source: B. Challenges · p. 9
  • Suggested research directions include regularization and dynamically adjusted learning rates to address non-IID deletion challenges.Source: B. Challenges · p. 9
  • Stratified unlearning could preserve the dataset’s original distribution, while meta-learning could train models to forget effectively.Source: B. Challenges · p. 9
  • Dynamic settings raise concerns about unpredictable performance changes, scaling update overhead, incomplete removal of sensitive data, and robustness to attacks or unfamiliar inputs.Source: B. Challenges · p. 9

VIII. SUMMARY

The survey reviews exact and approximate machine-unlearning techniques and compares their merits and shortcomings. Its evaluations support performance preservation particularly in IID settings, while identifying non-IID deletion and attack evaluation as unresolved hurdles.

VIII. SUMMARY

  • The survey examines current exact and approximate machine-unlearning methods, compares them, and discusses their merits and shortcomings.Source: §VIII · p. 9
  • The evaluations indicate that unlearning can remove sensitive data or biases without significantly impairing performance, particularly in IID settings.Source: §VIII · p. 9
  • Further work faces hurdles in robust non-IID sample deletion and evaluating unlearning effectiveness against potential attacks.Source: §VIII · p. 9
Loading 2305.07512v2…