Remember What You Want to Forget: Algorithms for Machine Unlearning

We study the problem of unlearning datapoints from a learnt model. The learner first receives a dataset S drawn i.i.d. from an unknown distribution, and outputs a model b w that performs well on unseen samples from the same distribution. However, at some point in the future, any training datapoint z 2 S can request to be unlearned, thus prompting the learner to modify its output model while still ensuring the same accuracy guarantees. We initiate a rigorous study of generalization in machine unlearning, where the goal is to perform well on previously unseen datapoints. Our focus is on both computational and storage complexity. For the setting of convex losses, we provide an unlearning algorithm that can unlearn up to O(n/d1/4) samples, where d is the problem dimension. In comparison, in general, differentially private learning (which implies unlearning) only guarantees deletion of O(n/d1/2) samples. This demonstrates a novel separation between differential privacy and machine unlearning.

[1]  Patrick Jaillet,et al.  Variational Bayesian Unlearning , 2020, NeurIPS.

[2]  Ichiro Takeuchi,et al.  Multiple Incremental Decremental Learning of Support Vector Machines , 2009, IEEE Transactions on Neural Networks.

[3]  Lluís A. Belanche Muñoz,et al.  Incremental and Decremental Learning for Linear Support Vector Machines , 2007, ICANN.

[4]  Dawn Xiaodong Song,et al.  Lifelong Anomaly Detection Through Unlearning , 2019, CCS.

[5]  Raef Bassily,et al.  Private Stochastic Convex Optimization with Optimal Rates , 2019, NeurIPS.

[6]  Shai Ben-David,et al.  Understanding Machine Learning: From Theory to Algorithms , 2014 .

[7]  Kamalika Chaudhuri,et al.  Approximate Data Deletion from Machine Learning Models: Algorithms and Evaluations , 2020, ArXiv.

[8]  Úlfar Erlingsson,et al.  The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks , 2018, USENIX Security Symposium.

[9]  Sanjam Garg,et al.  Formalizing Data Deletion in the Context of the Right to Be Forgotten , 2020, IACR Cryptol. ePrint Arch..

[10]  Ryan A. Rossi,et al.  Machine Unlearning via Algorithmic Stability , 2021, COLT.

[11]  Daniel M. Kane,et al.  Robust Estimators in High Dimensions without the Computational Intractability , 2016, 2016 IEEE 57th Annual Symposium on Foundations of Computer Science (FOCS).

[12]  Michael Backes,et al.  When Machine Unlearning Jeopardizes Privacy , 2020, CCS.

[13]  Stefano Soatto,et al.  Mixed-Privacy Forgetting in Deep Networks , 2021, 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR).

[14]  David Lie,et al.  Machine Unlearning , 2019, 2021 IEEE Symposium on Security and Privacy (SP).

[15]  Salil P. Vadhan,et al.  The Complexity of Differential Privacy , 2017, Tutorials on the Foundations of Cryptography.

[16]  John Darzentas,et al.  Problem Complexity and Method Efficiency in Optimization , 1983 .

[17]  Junfeng Yang,et al.  Towards Making Systems Forget with Machine Unlearning , 2015, 2015 IEEE Symposium on Security and Privacy.

[18]  Seth Neel,et al.  Descent-to-Delete: Gradient-Based Methods for Machine Unlearning , 2020, ALT.

[19]  Sébastien Bubeck,et al.  Convex Optimization: Algorithms and Complexity , 2014, Found. Trends Mach. Learn..

[20]  David M. Sommer,et al.  Towards Probabilistic Verification of Machine Unlearning , 2020, ArXiv.

[21]  Stefano Soatto,et al.  Eternal Sunshine of the Spotless Net: Selective Forgetting in Deep Networks , 2020, 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR).

[22]  Santosh S. Vempala,et al.  Agnostic Estimation of Mean and Covariance , 2016, 2016 IEEE 57th Annual Symposium on Foundations of Computer Science (FOCS).

[23]  Vitaly Feldman,et al.  Generalization of ERM in Stochastic Convex Optimization: The Dimension Strikes Back , 2016, NIPS.

[24]  Karthik Sridharan,et al.  SGD: The Role of Implicit Regularization, Batch-size and Multiple-epochs , 2021, NeurIPS.

[25]  Amund Tveit,et al.  Incremental and Decremental Proximal Support Vector Classification using Decay Coefficients , 2003, DaWaK.

[26]  L. V. D. Maaten,et al.  Certified Data Removal from Machine Learning Models , 2019, ICML.

[27]  Gert Cauwenberghs,et al.  Incremental and Decremental Support Vector Machine Learning , 2000, NIPS.

[28]  Aaron Roth,et al.  The Algorithmic Foundations of Differential Privacy , 2014, Found. Trends Theor. Comput. Sci..

[29]  Moni Naor,et al.  Our Data, Ourselves: Privacy Via Distributed Noise Generation , 2006, EUROCRYPT.

[30]  Cynthia Dwork,et al.  Calibrating Noise to Sensitivity in Private Data Analysis , 2006, TCC.

[31]  Ohad Shamir,et al.  Stochastic Convex Optimization , 2009, COLT.

[32]  James Zou,et al.  Making AI Forget You: Data Deletion in Machine Learning , 2019, NeurIPS.

[33]  Vitaly Shmatikov,et al.  Membership Inference Attacks Against Machine Learning Models , 2016, 2017 IEEE Symposium on Security and Privacy (SP).