Mixed-Privacy Forgetting in Deep Networks

Golatkar, Aditya; Achille, Alessandro; Ravichandran, Avinash; Polito, Marzia; Soatto, Stefano

doi:10.1109/cvpr46437.2021.00085

Cited by 72 publications

(52 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In these methods, the influence of the forget data on the model is approximated with a Newton step and a random noise in injected to the training objective function. The second group [Golatkar et al, 2020a;Golatkar et al, 2020b;Golatkar et al, 2021] requires access to the rest of the training data (excluding the forget data). These methods use the Fisher information and inject optimal noise to the model weights to achieve unlearning.…”

Section: Related Workmentioning

confidence: 99%

“…Most of the solutions are limited to simple linear and logistic regression. Few methods [Golatkar et al, 2020a;Golatkar et al, 2020b;Golatkar et al, 2021] have been proposed that can forget information from the CNN network weights with reasonable success in small scale to large scale vision problems. Unlearning in CNN is quite difficult due to its vastly non-convex loss-landscape which makes it difficult to model the effect of a data sample on the optimization trajectory and the final network weights configuration.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Zero-Shot Machine Unlearning

Chundawat¹,

Tarun²,

Mandal³

et al. 2022

Preprint

View full text Add to dashboard Cite

With the introduction of new privacy regulations, machine unlearning is becoming an emerging research problem due to an increasing need for regulatory compliance required for machine learning (ML) applications. Modern privacy regulations grant citizens the right to be forgotten by products, services and companies. This necessitates deletion of data not only from storage archives but also from ML model. The right to be forgotten requests come in the form of removal of a certain set or class of data from the already trained ML model. Practical considerations preclude retraining of the model from scratch minus the deleted data. The few existing studies use the whole training data, or a subset of training data, or some metadata stored during training to update the model weights for unlearning. However, strict regulatory compliance requires time-bound deletion of data. Thus, in many cases, no data related to the training process or training samples may be accessible even for the unlearning purpose. We therefore ask the question: is it possible to achieve unlearning with zero training samples? In this paper, we introduce the novel problem of zero-shot machine unlearning that caters for the extreme but practical scenario where zero original data samples are available for use. We then propose two novel solutions for zero-shot machine unlearning based on (a) error minimizing-maximizing noise and (b) gated knowledge transfer. We also introduce a new evaluation metric, Anamnesis Index (AIN) to effectively measure the quality of the unlearning method. The experiments show promising results for unlearning in deep learning models on benchmark vision datasets. The source code will be made publicly available.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Zero-Shot Machine Unlearning

Chundawat¹,

Tarun²,

Mandal³

et al. 2022

Preprint

View full text Add to dashboard Cite

show abstract

“…Comparability: Metrics should enable choosing between unlearning procedures in the presence of differing training procedures and architectures as such changes are often used to enable better unlearning [11,[27][28][29][30]35]. As mentioned in Table 1, L2-weights cannot be compared if there is any architectural modification.…”

Section: Approachmentioning

confidence: 99%

“…Many different black-box formulations of MIA have been used to measure the efficacy of unlearning. Most [27,29,30,45] learn a binary attack classifier: based on the model's output for the sample, was the sample in the seen training set (class 0) or the unseen test set (class 1)? The attack classifier is then applied on deletion set samples, with ideal unlearning entailing all samples are classified as unseen.…”

Section: B1 Backgroundmentioning

confidence: 99%

“…Note that the list of metrics in Table 1 of the main paper does not include metrics like upper bound on information remaining in weights and activations [27][28][29] since its unclear whether such metrics can be computed on methods other than their own proposed unlearning procedure. We also exclude purely-qualitative tests such as model inversion attacks [22] which have been used in prior unlearning works [10,30].…”

Section: D2 Metrics D21 On the Metric Comparisons Tablementioning

confidence: 99%

See 1 more Smart Citation

Towards Adversarial Evaluations for Inexact Machine Unlearning

Goel¹,

Prabhu²,

Kumaraguru³

2022

Preprint

View full text Add to dashboard Cite

Existing works in inexact machine unlearning focus on achieving indistinguishability from models retrained after removing the deletion set. We argue that indistinguishability is unnecessary, infeasible to measure, and its practical relaxations can be insufficient. We redefine the goal of unlearning as forgetting all information specific to the deletion set while maintaining high utility and resource efficiency.Motivated by the practical application of removing mislabelled and biased data from models, we introduce a novel test to measure the degree of forgetting called Interclass Confusion (IC). It allows us to analyze two aspects of forgetting: (i) memorization and (ii) property generalization. Despite being a black-box test, IC can investigate whether information from the deletion set was erased until the early layers of the network. We empirically show that two simple unlearning methods, exact-unlearning and catastrophic-forgetting the final k layers of a network, scale well to large deletion sets unlike prior unlearning methods. k controls the forgettingefficiency tradeoff at similar utility. Overall, we believe our formulation of unlearning and the IC test will guide the design of better unlearning algorithms.* Equal Contribution 1 to the extent that bias is a dataset problem [37].

show abstract

Attaining Class-Level Forgetting in Pretrained Model Using Few Samples

Singh

Mazumder

Asad

2022

Lecture Notes in Computer Science

View full text Add to dashboard Cite

In order to address real-world problems, deep learning models are jointly trained on many classes. However, in the future, some classes may become restricted due to privacy/ethical concerns, and the restricted class knowledge has to be removed from the models that have been trained on them. The available data may also be limited due to privacy/ethical concerns, and re-training the model will not be possible. We propose a novel approach to address this problem without affecting the model's prediction power for the remaining classes. Our approach identifies the model parameters that are highly relevant to the restricted classes and removes the knowledge regarding the restricted classes from them using the limited available training data. Our approach is significantly faster and performs similar to the model re-trained on the complete data of the remaining classes.

show abstract

Mixed-Privacy Forgetting in Deep Networks

Cited by 72 publications

References 7 publications

Zero-Shot Machine Unlearning

Zero-Shot Machine Unlearning

Towards Adversarial Evaluations for Inexact Machine Unlearning

Attaining Class-Level Forgetting in Pretrained Model Using Few Samples

Contact Info

Product

Resources

About