[Paper Review] Remember What You Want to Forget: Algorithms for Machine Unlearning

Ayush Sekhari, Jayadev Acharya+2 more|arXiv (Cornell University)|Mar 4, 2021

Privacy-Preserving Technologies in DataComputer Science32 references67 citations

TL;DR

The paper studies generalization in machine unlearning, introducing an unlearning algorithm for convex losses that deletes up to O(n/d^{1/4}) samples with good test performance, and showing a separation from differential privacy.

ABSTRACT

We study the problem of unlearning datapoints from a learnt model. The learner first receives a dataset $S$ drawn i.i.d. from an unknown distribution, and outputs a model $\widehat{w}$ that performs well on unseen samples from the same distribution. However, at some point in the future, any training datapoint $z \in S$ can request to be unlearned, thus prompting the learner to modify its output model while still ensuring the same accuracy guarantees. We initiate a rigorous study of generalization in machine unlearning, where the goal is to perform well on previously unseen datapoints. Our focus is on both computational and storage complexity. For the setting of convex losses, we provide an unlearning algorithm that can unlearn up to $O(n/d^{1/4})$ samples, where $d$ is the problem dimension. In comparison, in general, differentially private learning (which implies unlearning) only guarantees deletion of $O(n/d^{1/2})$ samples. This demonstrates a novel separation between differential privacy and machine unlearning.

Motivation & Objective

• Investigate how many training samples can be unlearned while preserving generalization to unseen data.
• Explore storage- and computation-efficient unlearning under practical memory constraints.
• Show separation between machine unlearning and differential privacy when deleting data.
• Develop unlearning algorithms that do not require access to the full training data at deletion time.

Proposed method

• Define population (test) loss versus empirical loss to motivate unlearning targets.
• Introduce an unlearning framework with statistics T(S) that enables deletion without storing all data.
• Prove a separation: DP-based unlearning yields deletion capacity ~ n/d^{1/2}, while our convex-loss method achieves ~ n/d^{1/4}.
• Provide an unlearning algorithm for strongly convex losses that uses Hessian information and noise to achieve DP-like guarantees with smaller noise.
• Show that the unlearning algorithm stores O(d^2) statistics and runs in time O(d^{ω}).
• Extend from strongly convex to convex losses via a reduction using regularization.

Experimental results

Research questions

• RQ1 How many samples can be deleted from a trained model while preserving good test loss guarantees?
• RQ2 How do storage and computation requirements influence the design of unlearning algorithms?
• RQ3 Can unlearning beat the DP-based deletion capacity in convex loss settings?
• RQ4 What are the trade-offs between deletion capacity, memory usage, and computational efficiency?
• RQ5 Does unlearning based on sample-aware updates yield better generalization than DP-only approaches?

Key findings

• For convex (and strongly convex) losses, there exists an unlearning algorithm that can delete up to m ≥ c · n · sqrt(ε) / (d log(1/δ))^{1/4} samples while preserving an excess risk of 0.01.
• The proposed unlearning method stores Hessian-based statistics with memory O(d^2) and achieves unlearning in time O(d^{ω}).
• The noise added for unlearning can be smaller than DP noise by a factor proportional to n^2/m^2, enabling higher deletion capacity.
• A strict separation is demonstrated: DP-based learning yields deletion capacity ~ n/d^{1/2}, whereas the new algorithm achieves ~ n/d^{1/4} for convex losses.
• The results hold for both strongly convex and convex losses, with the learned solution maintaining near-optimal test loss after deletions.