[Paper Review] Corrective Machine Unlearning

Shashwat Goel, Ameya Prabhu+3 more|arXiv (Cornell University)|Feb 21, 2024

Educational Technology and Assessment4 citations

TL;DR

This paper introduces Corrective Machine Unlearning, a novel framework to mitigate the effects of manipulated data in already-trained machine learning models when only a representative subset of corrupted samples is known. Unlike traditional unlearning methods that prioritize privacy, it focuses on restoring model accuracy on affected data domains, demonstrating that selective synaptic dampening (SSD) can effectively unlearn backdoor triggers with as little as 10% identified poisoned samples, while retraining-from-scratch fails even with 80% identified data.

ABSTRACT

Machine Learning models increasingly face data integrity challenges due to the use of large-scale training datasets drawn from the Internet. We study what model developers can do if they detect that some data was manipulated or incorrect. Such manipulated data can cause adverse effects including vulnerability to backdoored samples, systemic biases, and reduced accuracy on certain input domains. Realistically, all manipulated training samples cannot be identified, and only a small, representative subset of the affected data can be flagged. We formalize Corrective Machine Unlearning as the problem of mitigating the impact of data affected by unknown manipulations on a trained model, only having identified a subset of the corrupted data. We demonstrate that the problem of corrective unlearning has significantly different requirements from traditional privacy-oriented unlearning. We find most existing unlearning methods, including retraining-from-scratch without the deletion set, require most of the manipulated data to be identified for effective corrective unlearning. However, one approach, Selective Synaptic Dampening, achieves limited success, unlearning adverse effects with just a small portion of the manipulated samples in our setting, which shows encouraging signs for future progress. We hope our work spurs research towards developing better methods for corrective unlearning and offers practitioners a new strategy to handle data integrity challenges arising from web-scale training. Code is available at https://github.com/drimpossible/corrective-unlearning-bench.

Motivation & Objective

• To address the challenge of restoring model accuracy after training on data corrupted by subtle, undetected manipulations such as backdoors or mislabeling.
• To formalize a new unlearning paradigm—Corrective Machine Unlearning—that differs fundamentally from privacy-oriented unlearning by focusing on performance recovery rather than data privacy.
• To evaluate existing unlearning methods in this new setting, revealing that traditional approaches like retraining-from-scratch fail when only a fraction of manipulated data is known.
• To demonstrate the feasibility of corrective unlearning using selective synaptic dampening (SSD), which shows promise in removing backdoor effects with minimal identified data.
• To motivate future research into robust, adaptive unlearning algorithms tailored for data integrity issues in large-scale web-trained models.

Proposed method

• The paper formalizes Corrective Machine Unlearning as a problem where only a representative subset of manipulated samples is known, and the goal is to improve clean-label accuracy on the affected data domain.
• It evaluates state-of-the-art unlearning methods—including retraining-from-scratch and SSD—on two types of data manipulations: BadNet-style backdoor poisoning and Interclass Confusion mislabeling.
• The approach uses a threat model where adversaries manipulate data via triggers or label swaps, and model developers only detect a small, representative fraction of such samples post-training.
• It introduces a new evaluation metric focused on accuracy improvement on the manipulated domain rather than distributional indistinguishability from retraining.
• It benchmarks methods under realistic conditions where the full extent of data corruption is unknown, simulating real-world data integrity challenges.
• It proposes that future methods should prioritize accuracy recovery on corrupted domains over strict privacy guarantees, especially under adaptive attacks.

Figure 1 : Traditionally, retraining after removing identified data is considered a gold standard in unlearning. However, since developers may not identify all the wrong data for unlearning, retraining-from-scratch on remaining data leads to poor clean-label accuracy. Ideally, corrective unlearning

Experimental results

Research questions

• RQ1 Can existing unlearning methods effectively restore model accuracy on data domains affected by unknown data manipulations when only a subset of corrupted samples is identified?
• RQ2 Why do traditional unlearning approaches like retraining-from-scratch fail in corrective unlearning, even when 80% of the manipulated data is known?
• RQ3 To what extent can selective synaptic dampening (SSD) unlearn the effects of backdoor poisoning with only 10% of the manipulated samples identified?
• RQ4 Why does SSD fail to mitigate Interclass Confusion mislabeling, and what does this imply about the generalizability of current unlearning methods?
• RQ5 What theoretical and algorithmic conditions make a small representative set of manipulated samples sufficient for effective corrective unlearning?

Key findings

• Retraining-from-scratch fails to restore clean-label accuracy on the affected domain even when 80% of the manipulated data is identified, highlighting the insufficiency of this gold-standard approach in corrective unlearning.
• Selective Synaptic Dampening (SSD) successfully mitigates the effects of BadNet-style backdoor poisoning with only 10% of the manipulated samples identified, demonstrating the tractability of corrective unlearning in this setting.
• SSD fails to unlearn the effects of Interclass Confusion mislabeling, indicating that current unlearning methods are not robust across diverse manipulation types.
• The study reveals a fundamental disconnect between privacy-oriented unlearning objectives and the needs of data integrity recovery, showing that indistinguishability from retraining is insufficient for corrective performance.
• The results underscore the need for new unlearning algorithms specifically designed for data integrity issues, with a focus on accuracy recovery rather than privacy guarantees.
• The paper identifies a critical research gap: no existing method reliably unlearns arbitrary data manipulations with only a small, representative subset of corrupted samples.

Figure 2 : Clean-label Accuracy on Test Samples with Poison Trigger . Each method is shown across deletion sizes $|S_{f}|$ after unlearning (“None” represents the original model). Existing unlearning methods except SSD, including EU which is traditionally considered a gold-standard, perform poorly w