2020

Machine Unlearning: Linear Filtration for Logit-based Classifiers

Baumhauer, Thomas, Schöttle, Pascal, Zeppelzauer, Matthias

Understand

Recently enacted legislation grants individuals certain rights to decide in what fashion their personal data may be used, and in particular a "right to be forgotten".

This poses a challenge to machine learning: how to proceed when an individual retracts permission to use data which has been part of the training process of a model? From this question emerges the field of machine unlearning, which could be broadly described as the investigation of how to "delete training data from models".
Our work complements this direction of research for the specific setting of class-wide deletion requests for classification models (e.g.
deep neural networks).

Built on

AT&T Laboratories Cambridge, “The database of faces,” 1994
1994
Earlier work this paper cites.
M. Kearns, “Efficient noise-tolerant learning from statistical queries,” J. ACM , 1998
1998
Earlier work this paper cites.
Y. Lecun, L. Bottou, Y. Bengio, and P. Haffner, “Gradient-based learning applied to document recognition,” Proceedings of the IEEE , 1998
1998
Earlier work this paper cites.
C. Dwork, F. McSherry, K. Nissim, and A. Smith, “Calibrating noise to sensitivity in private data analysis,” in Theory of Cryptography , S. Halevi and T. Rabin, Eds., 2006
2006
Earlier work this paper cites.
A. Krizhevsky, “Learning multiple layers of features from tiny images,” University of Toronto, Tech. Rep., 2009
2009
Earlier work this paper cites.
M. Fredrikson, E. Lantz, S. Jha, S. Lin, D. Page, and T. Ristenpart, “Privacy in pharmacogenetics: An end-to-end case study of personalized warfarin dosing,” in Proceedings of the 23rd USENIX Conference on Security Symposium , 2014
2014
Earlier work this paper cites.
C. Dwork and A. Roth, “The algorithmic foundations of differential privacy,” Found. Trends Theor. Comput. Sci. , 2014
2014
Earlier work this paper cites.
Y. Cao and J. Yang, “Towards making systems forget with machine unlearning,” in 2015 IEEE Symposium on Security and Privacy , 2015
2015
Earlier work this paper cites.
M. Fredrikson, S. Jha, and T. Ristenpart, “Model inversion attacks that exploit confidence information and basic countermeasures,” in Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security , 2015
2015
Earlier work this paper cites.
Council of European Union, “Regulation (eu) 2016/679,” 2016, accessed: August 24, 2026. [Online]. Available: https://eur-lex.europa.eu/eli/reg/2016/679/oj
2016
Earlier work this paper cites.
F. McSherry, “Statistical inference considered harmful,” 2016, accessed: August 24, 2026. [Online]. Available: https://github.com/frankmcsherry/blog/blob/master/posts/2016-06-14.md
2016
Earlier work this paper cites.

Similar

M. Abadi, A. Chu, I. Goodfellow, B. McMahan, I. Mironov, K. Talwar, and L. Zhang, “Deep learning with differential privacy,” in 23rd ACM Conference on Computer and Communications Security (ACM CCS) , 2016
2016
Cited alongside, same era.
K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , 2016
2016
Cited alongside, same era.
P. W. Koh and P. Liang, “Understanding black-box predictions via influence functions,” Proceedings of the 34th International Conference on Machine Learning , 2017
2017
Cited alongside, same era.
R. Shokri, M. Stronati, C. Song, and V. Shmatikov, “Membership inference attacks against machine learning models,” in 2017 IEEE Symposium on Security and Privacy (SP) , 2017
2017
Cited alongside, same era.
E. F. Villaronga, P. Kieseberg, and T. J. Li, “Humans forget, machines remember: Artificial intelligence and the right to be forgotten,” Computer Law & Security Review , 2018
2018
Cited alongside, same era.
S. Yeom, I. Giacomelli, M. Fredrikson, and S. Jha, “Privacy risk in machine learning: Analyzing the connection to overfitting,” 2018 IEEE 31st Computer Security Foundations Symposium (CSF) , 2018
2018
Cited alongside, same era.
M. Veale, R. Binns, and L. Edwards, “Algorithms that remember: model inversion attacks and data protection law,” Philosophical Transactions of the Royal Society A: Mathematical, Physical and Engineering Sciences , 2018
2018
Cited alongside, same era.
A. Jacot, F. Gabriel, and C. Hongler, “Neural tangent kernel: Convergence and generalization in neural networks,” Advances in Neural Information Processing Systems , 2018
2018
Cited alongside, same era.
A. Sablayrolles, M. Douze, C. Schmid, Y. Ollivier, and H. Jegou, “White-box vs black-box: Bayes optimal strategies for membership inference,” in International Conference on Machine Learning , 2019
2019
Cited alongside, same era.
N. Carlini, C. Liu, Ú. Erlingsson, J. Kos, and D. Song, “The secret sharer: Evaluating and testing unintended memorization in neural networks,” in 28th USENIX Security Symposium (USENIX Security 19) , 2019
2019
Cited alongside, same era.
A. Ginart, M. Guan, G. Valiant, and J. Y. Zou, “Making ai forget you: Data deletion in machine learning,” in Advances in Neural Information Processing Systems 32 , 2019
2019
Cited alongside, same era.

Then

L. Bourtoule, V. Chandrasekaran, C. Choquette-Choo, H. Jia, A. Travers, B. Zhang, D. Lie, and N. Papernot, “Machine unlearning,” arXiv preprint arXiv:1912.03817 , 2019
Original
2019
Later among the works it cites.
C. Guo, T. Goldstein, A. Hannun, and L. van der Maaten, “Certified data removal from machine learning models,” arXiv 1911.03030 , 2019
2019
Later among the works it cites.
J. Lee, L. Xiao, S. Schoenholz, Y. Bahri, J. Sohl-Dickstein, and J. Pennington, “Wide neural networks of any depth evolve as linear models under gradient descent,” Advances in Neural Information Processing Systems , 2019
2019
Later among the works it cites.
J. Hayes, L. Melis, G. Danezis, and E. De Cristofaro, “LOGAN: membership inference attacks against generative models,” PoPETs , 2019
2019
Later among the works it cites.
A. Achille, G. Paolini, and S. Soatto, “Where is the information in a deep neural network?” arXiv 1905.12213 , 2019
2019
Later among the works it cites.
A. Golatkar, A. Achille, and S. Soatto, “Eternal sunshine of the spotless net: Selective forgetting in deep networks,” IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , 2020
2020
Closest in time.
——, “Forgetting outside the box: Scrubbing deep networks of information accessible from input-output observations,” arXiv 2003.02960 , 2020
2020
Closest in time.
D. M. Sommer, L. Song, S. Wagh, and P. Mittal, “Towards probabilistic verification of machine unlearning,” arXiv 2003.04247 , 2020
2020
Closest in time.
——, “Regulation (eu) 2012/0011,” 2012, accessed: August 24, 2026. [Online]. Available: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52012PC0011
2026
Closest in time.
State of California, “California Consumer Privacy Act,” 2018, accessed: August 24, 2026. [Online]. Available: https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_ id=201720180AB375
2026
Closest in time.

Beyond the bibliography

alphaXiv searches the wider corpus for related work and actual follow-ups.

Open on alphaXiv

alphaXiv is searching for related work…

Reading the bibliography…