[Paper Review] Descent-to-Delete: Gradient-Based Methods for Machine Unlearning

Seth Neel, Aaron Roth+1 more|arXiv (Cornell University)|Jul 6, 2020

Privacy-Preserving Technologies in DataComputer Science14 references54 citations

TL;DR

The paper develops gradient-based unlearning methods for convex models that preserve statistical indistinguishability from retraining under an arbitrary sequence of updates, with strong and weak unlearning notions and a distributed approach for high-dimensional data.

ABSTRACT

We study the data deletion problem for convex models. By leveraging techniques from convex optimization and reservoir sampling, we give the first data deletion algorithms that are able to handle an arbitrarily long sequence of adversarial updates while promising both per-deletion run-time and steady-state error that do not grow with the length of the update sequence. We also introduce several new conceptual distinctions: for example, we can ask that after a deletion, the entire state maintained by the optimization algorithm is statistically indistinguishable from the state that would have resulted had we retrained, or we can ask for the weaker condition that only the observable output is statistically indistinguishable from the observable output that would have resulted from retraining. We are able to give more efficient deletion algorithms under this weaker deletion criterion.

Motivation & Objective

• Address the data deletion problem for convex models in an online setting with arbitrary add/delete updates.
• Define and compare perfect (state-level) versus observable-output indistinguishability in unlearning.
• Develop strong and weak unlearning algorithms with fixed per-update computation budgets.
• Leverage perturbation and distributed optimization to achieve (ε,δ)-unlearning with favorable accuracy-runtime trade-offs.
• Explore regularization-based strategies to handle non-strongly convex losses while maintaining deletion guarantees.

Proposed method

• Use perturbed gradient descent (PGD) initialized from the previous round to achieve close-to-optimal parameters before each update.
• Add Gaussian noise via a publishing function to ensure (ε,δ)-indistinguishability of outputs within a neighborhood of the optimum.
• Develop a strong unlearning framework where per-update cost grows at most logarithmically with the update sequence length.
• Introduce a distributed PGD variant that partitions data, trains independently per partition, and averages parameters with reservoir sampling to preserve distributional guarantees.
• Regularize convex losses to induce strong convexity, enabling the same unlearning guarantees with trade-offs between regularization strength and accuracy.
• Relate the approach to reservoir sampling and Subsample-and-Aggregate techniques to maintain deletion guarantees across updates.

Experimental results

Research questions

• RQ1 How can we delete data from convex models so that the resulting output is statistically indistinguishable from retraining?
• RQ2 What are the trade-offs between perfect (state-level) and observable-output indistinguishability in machine unlearning?
• RQ3 Can gradient-based methods provide strong (ε,δ)-unlearning with per-update computation costs that do not scale with the update sequence length?
• RQ4 Does a distributed partitioned training approach improve the accuracy-runtime trade-off for high-dimensional data under repeated updates?
• RQ5 How does regularization to enforce strong convexity impact deletion guarantees and model accuracy?

Key findings

• We obtain strong, perfect unlearning for strongly convex and smooth losses with per-update computation that is logarithmic in the update index when using Gaussian perturbation.
• For convex or non-strongly convex losses, we can still achieve strong or perfect unlearning by maintaining secret state or by applying regularization to induce strong convexity.
• A distributed PGD approach with reservoir sampling maintains distributional guarantees across arbitrarily long update sequences and improves accuracy-runtime trade-offs in high dimensions.
• The proposed methods achieve (ε,δ)-unlearning, with the published outputs being differentially private, mitigating membership inference risks.
• We provide detailed bounds showing the relationship between update budget, noise level, and resulting accuracy under various convexity/smoothness assumptions.
• The work connects unlearning guarantees to notions from differential privacy and Subsample-and-Aggregate methods, situating it within the broader private-learning literature.