cs.LGOct 3, 2024
SaveInstance-Level Difficulty: A Missing Perspective in Machine Unlearning
Organizations: Department of Computer Science, Dalhousie University, Canada.
Abstract
Current research on deep machine unlearning primarily focuses on improving or evaluating the overall effectiveness of unlearning methods while overlooking the varying difficulty of unlearning individual training samples. As a result, the broader feasibility of machine unlearning remains under-explored. This paper studies the cruxes that make machine unlearning difficult through a thorough instance-level unlearning performance analysis over various unlearning algorithms and datasets. In particular, we summarize four factors that make unlearning a data point difficult, and we empirically show that these factors are independent of a specific unlearning algorithm but only relevant to the target model and its training data. Given these findings, we argue that machine unlearning research should pay attention to the instance-level difficulty of unlearning.
Figures & tables
Figure 1: Effectiveness of using Tolerance of Preference Shift (TPS) as an index of unlearning difficulty. For the four different unlearning algorithms, we note there is a consistent positive alignment between TPS and empirical unlearning outcome (GT). The experiments are conducted on ResNet-18 model trained on SVHN dataset.
Figure 2: Effectiveness of using Distance of Preference Shift (DPS) as an index of unlearning difficulty. For the tree out of four different unlearning algorithms, we observe a negative alignment between DPS and empirical unlearning outcome (GT). For SalUn, there is no clear correlation between DPS and GT. The experiments are conducted on ResNet-18 model trained on SVHN dataset.
Figure 3: Effectiveness of using Geometric Distance to Decision Boundary (GDDB) as an index of unlearning difficulty. (Top) Distance to decision boundary estimated through DeepFool in adversarial learning literature. (Bottom) Distance to the decision boundary is estimated by treating the last layer of a neural network as a linear classifier. There is no observable correlation between empirical unlearning difficulty and training data’s geometric distance to the decision boundary. The experiments is conducted on ResNet-18 model trained on SVHN dataset.
Figure 4: Effectiveness of using Number of Unlearning Epochs (NUE) as an index of unlearning difficulty. We observed noisy negative alignment between NUE and GT for gradient based approaches. For SCRUB and SalUn, there is no observable correlation. The experiments are conducted on ResNet-18 model trained on SVHN dataset.
Figure 5: Effectiveness of MIA as index of unlearning difficulty. A prediction of ”1” indicates successful unlearning, where the unlearned model no longer retains information about the data, while ”0” signifies failed unlearning, where the model still remembers the unlearned samples. We observed noisy positive alignment between MIA and GT for gradient based approaches. The larger the GT, the easier the data point for unlearning and this is positively associated with MIA=”1”. For SCRUB there is no observable correlation. The experiments are conducted on ResNet-18 model trained on SVHN dataset.
Figure 6: Effectiveness of Size of Unlearning Expansion (SUE) as an index of unlearning difficulty. The similarity each data point is measured by KDE at that point. Higher density values indicate that the data point lies in a region with many similar samples. From the obtained results there is no correlation between SUE and GT. The experiments are conducted on ResNet-18 model trained on SVHN dataset.
| SalUn | NG | SCRUB | GA | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Factor/Metric | Corr | p-value | Corr | p-value | Corr | p-value | Corr | p-value | |
| SVHN | Test Accuracy (TPS) | 0.2507 | 0.9981 | 0.0 | 0.9879 | 0.0 | 0.9996 | 0.0 | |
| Model Distance - KL (DPS) | 0.4414 | -0.5548 | -0.7820 | -0.7988 | |||||
| Model Distance - Absolute (DPS) | 0.3648 | -0.5706 | -0.8133 | -0.7898 | |||||
| Forget Predictive Probability Difference | 0.7974 | -0.1288 | -0.6125 | 0.3618 | |||||
| Test Predictive Probability Difference | -0.2547 | -0.9999 | 0.0 | -0.9999 | 0.0 | -0.9998 | 0.0 | ||
Table 1: The correlation and p-value results between the GT score and various factors examined in this study for different unlearning methods. The term ”metrics” following the factor abbreviations indicates the specific measurements used in the empirical evaluation.
Appendix figures & tables18 assets
Supplementary material from the paper’s appendix.
Appendix
| Algorith | Unlearning rate | Unlearning steps | |
|---|---|---|---|
| Gradient Ascent (GA) | 1e-4 | 20 | |
| NegGrad | 1e-4 | 20 | |
| SCRUB | 1e-3 | 20 | |
| SalUn | 0.01 | 20 | |
| Fine Tune (FT) | 1e-4 | 20 |
| Dataset | Model | Layers | Batch Size | Number of Classes | Learning Rate | Samples |
|---|---|---|---|---|---|---|
| MNIST | ResNet18 | 18 | 150 | 10 | 0.001 | 54000 |
| CIFAR10 | ResNet18 | 18 | 150 | 10 | 0.01 | 45000 |
| SVHN | ResNet18 | 18 | 64 | 10 | 0.001 | 58000 |
Table 2: This table details the datasets and models used in evaluating unlearning algorithms, specifying the models applied to each dataset, including the number of layers, batch sizes, number of classes, learning rates, and sample sizes. The information presented provides insight into the computational frameworks employed to analyze MNIST, CIFAR-10, and SVHN datasets, demonstrating the diversity of approaches used in the study.
Figure 7: Accuracy of the remaining data ( ) post-unlearning, presented consecutively from top to bottom for the SVHN, CIFAR-10, and MNIST datasets. For the four different unlearning algorithms, we note there is a consistent positive alignment between accuracy of remaining data and empirical unlearning outcome (GT).
Figure 8: Effectiveness of using Distance of Preference Shift (DPS) as index of unlearning difficulty. (Top) Absolute average layer-wise distance of the model’s weights pre- and post-unlearning. (Bottom) KL-divergence of model’s parameters before and after unlearning. The experiments is conducted on ResNet-18 model trained on CIFAR10 dataset.
Figure 9: Effectiveness of using Distance of Preference Shift (DPS) as index of unlearning difficulty. (Top) Absolute average layer-wise distance of the model’s weights pre- and post-unlearning. (Bottom) KL-divergence of model’s parameters before and after unlearning.
Figure 10: Effectiveness of using Geometric Distance to Decision Boundary (GDDB) as index of unlearning difficulty. (Top) Distance to decision boundary estimated through DeepFool in adversarial learning literature. (Bottom) Distance to decision boundary estimated by treating the last layer of neural network as linear classifier. The experiments is conducted on ResNet-18 model trained on CIFAR10 dataset.
Figure 11: Effectiveness of using Geometric Distance to Decision Boundary (GDDB) as index of unlearning difficulty. (Top) Distance to decision boundary estimated through DeepFool in adversarial learning literature. (Bottom) Distance to decision boundary estimated by treating the last layer of neural network as linear classifier. The experiments is conducted on ResNet-18 model trained on MNIST dataset.
Figure 12: Effectiveness of using Number of Unlearning Epochs (NUE) as index of unlearning difficulty. (Top) Number of epochs used to achieve guaranteed unlearning (flip of decision). (Bottom) Wall clock time elapsed to achive guaranteed unlearning. The experiments is conducted on ResNet-18 model trained on CIFAR10 dataset.
Figure 13: Effectiveness of using Number of Unlearning Epochs (NUE) as index of unlearning difficulty. (Top) Number of epochs used to achieve guaranteed unlearning (flip of decision). (Bottom) Wall clock time elapsed to achieve guaranteed unlearning. The experiments is conducted on ResNet-18 model trained on MNIST dataset.
Figure 14: Effectiveness of MIA as index of unlearning difficulty. A prediction of ”1” indicates successful unlearning, where the unlearned model no longer retains information about the data, while ”0” signifies failed unlearning, where the model still remembers the unlearned samples. The experiments is conducted on ResNet-18 model trained on (from top to bottom) CIFAR10 and MNIST datasets.
Figure 15: Top-3 easiest and and most difficult samples unlearned by GA, NegGrad, SCRUB and SalUn for machine unlearning flagged by ”Test Accuracy” presented in section 3.3 . In every picture, the top row (”Top Performing Samples”) is associated to easy samples and the bottom row (”Bottom Performing Samples”) for the difficult samples. The datasets shown (from top to bottom) are SVHN, CIFAR10, and MNIST, respectively.
Figure 16: Top-3 easiest and and most difficult samples unlearned by GA, NegGrad, SCRUB and SalUn for machine unlearning flagged by ”Test Loss Difference” presented in section 3.3 . In every picture, the top row (”Top Performing Samples”) is associated to easy samples and the bottom row (”Bottom Performing Samples”) for the difficult samples. The datasets shown (from top to bottom) are SVHN, CIFAR10, and MNIST, respectively.
Figure 17: Top-3 easiest and and most difficult samples unlearned by GA, NegGrad, SCRUB and SalUn for machine unlearning flagged by ”Forget Loss Difference” presented in section 3.3 . In every picture, the top row (”Top Performing Samples”) is associated to easy samples and the bottom row (”Bottom Performing Samples”) for the difficult samples. The datasets shown (from top to bottom) are SVHN, CIFAR10, and MNIST, respectively.
Figure 18: Top-3 easiest and and most difficult samples unlearned by GA, NegGrad, SCRUB and SalUn for machine unlearning flagged by ”Model Distance - Absolute” presented in section 3.3 . In every picture, the top row (”Top Performing Samples”) is associated to easy samples and the bottom row (”Bottom Performing Samples”) for the difficult samples. The datasets shown (from top to bottom) are SVHN, CIFAR10, and MNIST, respectively.
Figure 19: Top-3 easiest and and most difficult samples unlearned by GA, NegGrad, SCRUB and SalUn for machine unlearning flagged by ”Model Distance - KL” presented in section 3.3 . In every picture, the top row (”Top Performing Samples”) is associated to easy samples and the bottom row (”Bottom Performing Samples”) for the difficult samples. The datasets shown (from top to bottom) are SVHN, CIFAR10, and MNIST, respectively.
Figure 20: Top-3 easiest and and most difficult samples unlearned by GA, NegGrad, SCRUB and SalUn for machine unlearning flagged by ”Epoch Elapsed” presented in section 3.3 . In every picture, the top row (”Top Performing Samples”) is associated to easy samples and the bottom row (”Bottom Performing Samples”) for the difficult samples. The datasets shown (from top to bottom) are SVHN, CIFAR10, and MNIST, respectively.
Figure 21: Top-3 easiest and and most difficult samples unlearned by GA, NegGrad, SCRUB and SalUn for machine unlearning flagged by ”Time Elapsed” presented in section 3.3 . In every picture, the top row (”Top Performing Samples”) is associated to easy samples and the bottom row (”Bottom Performing Samples”) for the difficult samples. The presence of similar samples suggests that this factor identifies the easiest and most difficult cases independently of the unlearning algorithm. The datasets shown (from top to bottom) are SVHN, CIFAR10, and MNIST, respectively.
Figure 22: Top-3 easiest and and most difficult samples unlearned by GA, NegGrad, SCRUB and SalUn for machine unlearning flagged by ”MIA” presented in section 3.3 . In every picture, the top row (”Top Performing Samples”) is associated to easy samples and the bottom row (”Bottom Performing Samples”) for the difficult samples. The datasets shown (from top to bottom) are SVHN, CIFAR10, and MNIST, respectively.
More in this topic
Machine Unlearning
Machine unlearning removes the influence of selected data or concepts from trained models while preserving useful behavior and avoiding full retraining.
See all 343 papers