Adaptive Machine Unlearning

By Varun Gupta, Christopher Jung, Seth Neel, Aaron Roth, Saeed Sharifi-Malvajerdi, Chris Waites. 2021

244 citations recorded by the source corpus.

Data deletion algorithms aim to remove the influence of deleted data points from trained models at a cheaper computational cost than fully retraining those models. However, for sequences of deletions, most prior work in the non-convex setting gives valid guarantees only for sequences that are chosen independently of the models that are published. If people choose to delete their data as a function of the published models (because they don't like what the models reveal about them, for example), then the update sequence is adaptive. In this paper, we give a general reduction from deletion guarantees against adaptive sequences to deletion guarantees against non-adaptive sequences, using differential privacy and its connection to max information. Combined with ideas from prior work which give guarantees for non-adaptive deletion sequences, this leads to extremely flexible algorithms able to handle arbitrary model classes and training methodologies, giving strong provable deletion guarantees for adaptive deletion sequences. We show in theory how prior work for non-convex models fails against adaptive deletion sequences, and use this intuition to design a practical attack against the SISA algorithm of Bourtoule et al. [2021] on CIFAR-10, MNIST, Fashion-MNIST.

Subfields: Artificial Intelligence, Radiology, Nuclear Medicine and Imaging

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Radiology, Nuclear Medicine and Imaging

Citations in the corpus

Learning with Recoverable Forgetting (2022, neutral): “Gupta et al. [13] give a general reduction from deletion guarantees against adaptive sequences to deletion guarantees against non-adaptive sequences, using differential privacy and its connection to max information.”
Fast Yet Effective Machine Unlearning (2021, methodology): “[31] proposed an algorithm to handle a sequence of adaptive”
Unrolling SGD: Understanding Factors Influencing Machine Unlearning (2021, background): “, [24]): ideally, the distribution of weights of M ′ leaks no information about x∗ as it was not trained on it (though this is not necessarily the case [15]), and so the smaller the privacy leakage of x∗ from the distribution of weights of M ′′, the closer M ′′ is to being unlearned.”
A Survey of Machine Unlearning (2022, unknown): “( ′ | 𝑤 ) is assumed to be a As a result, a candidate set of model parameters 𝑃𝑟 ( 𝑤 | 𝐷 ) is constructed by simply maximizing the posterior probability 𝑃𝑟 ( 𝑤 | 𝐷 ) , i.e.:”
Detecting Pretraining Data from Large Language Models (2023, background): “…has emerged as a solution for purging data from machine learning models, and various machine unlearning methods have been introduced (Ginart et al., 2019; Liu et al., 2020; Wu et al., 2020; Bourtoule et al., 2021; Izzo et al., 2021; Sekhari et al., 2021; Gupta et al., 2021; Ye et al., 2022).”