Amnesiac Machine Learning

By Laura Graves, Vineel Nagisetty, Vijay Ganesh. AAAI Conference on Artificial Intelligence, 2020

458 citations recorded by the source corpus.

The Right to be Forgotten is part of the recently enacted General Data Protection Regulation (GDPR) law that affects any data holder that has data on European Union residents. It gives EU residents the ability to request deletion of their personal data, including training records used to train machine learning models. Unfortunately, Deep Neural Network models are vulnerable to information leaking attacks such as model inversion attacks which extract class information from a trained model and membership inference attacks which determine the presence of an example in a model's training data. If a malicious party can mount an attack and learn private information that was meant to be removed, then it implies that the model owner has not properly protected their user's rights and their models may not be compliant with the GDPR law. In this paper, we present two efficient methods that address this question of how a model owner or data holder may delete personal data from models in such a way that they may not be vulnerable to model inversion and membership inference attacks while maintaining model efficacy. We start by presenting a real-world threat model that shows that simply removing training data is insufficient to protect users. We follow that up with two data removal methods, namely Unlearning and Amnesiac Unlearning, that enable model owners to protect themselves against such attacks while being compliant with regulations. We provide extensive empirical analysis that show that these methods are indeed efficient, safe to apply, effectively remove learned information about sensitive data from trained models while maintaining model efficacy.

Subfields: Artificial Intelligence, Radiology, Nuclear Medicine and Imaging

View Paper: https://www.semanticscholar.org/paper/09227e0251dad7b972878720131ddaecfec6c47f

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Radiology, Nuclear Medicine and Imaging

Citations in the corpus

Emergent and Predictable Memorization in Large Language Models (2023, result): “While this exact experimental set-up and context is novel, it is still in tension with existing literature [22, 29, 51].”
Knowledge Unlearning for Mitigating Privacy Risks in Language Models (2022, background): “2.2 Machine Unlearning Machine unlearning has received attention as an alternative approach to overcome data privacy issues in machine learning (Cao and Yang, 2015; Ginart et al., 2019; Bourtoule et al., 2021; Graves et al., 2021).”
Towards Unbounded Machine Unlearning (2023, methodology): “Further, Huang and Canonne [2023] provide bounds for ‘deletion capacity’ in the DP-based unlearning methods using the group property of DP. [Graves et al., 2021] proposed two methods applicable to deep networks.”
Unrolling SGD: Understanding Factors Influencing Machine Unlearning (2021, methodology): “Instead of retraining, these methods execute computationally less expensive operations on the final weights [11, 8, 10], apply some architectural change [12], or filter outputs [12].”
Measuring Forgetting of Memorized Training Examples (2022, background): “Another empirical exploration of forgetting is found in Graves et al. [29].”
Fast Yet Effective Machine Unlearning (2021, methodology): “In the literature [9], [10], [3], [39] several metrics have been defined to measure the overall performance of an unlearning method.”
SalUn: Empowering Machine Unlearning via Gradient-based Weight Saliency in Both Image Classification and Generation (2023, background): “Still, these methods often have inherent limitations that hinder their practical effectiveness, especially in defending against membership inference attacks (Dwork et al., 2006; Graves et al., 2021).”
A Survey of Machine Unlearning (2022, unknown): “com/inspire-group/unlearning-verification AmnesiacML [58] Python Model-agnostic https://github.”
A Survey on Negative Transfer (2020, methodology): “1) Machine Unlearning: Aims to preserve data privacy in trained models by unlearning sensitive samples [33], [34].”