2024

Is Retain Set All You Need in Machine Unlearning? Restoring Performance of Unlearned Models with Out-Of-Distribution Images

Bonato, Jacopo, Cotogni, Marco, Sabetta, Luigi

Understand

In this paper, we introduce Selective-distillation for Class and Architecture-agnostic unleaRning (SCAR), a novel approximate unlearning method.

SCAR efficiently eliminates specific information while preserving the model's test accuracy without using a retain set, which is a key component in state-of-the-art approximate unlearning algorithms.
Our approach utilizes a modified Mahalanobis distance to guide the unlearning of the feature vectors of the instances to be forgotten, aligning them to the nearest wrong class distribution.
Moreover, we propose a distillation-trick mechanism that distills the knowledge of the original model into the unlearning model with out-of-distribution images for retaining the original model's test performance without using any retain set.

Built on

Massey Jr, F.J.: The kolmogorov-smirnov test for goodness of fit. Journal of the American statistical Association 46
1951
Earlier work this paper cites.
Tukey, J.W.: Exploratory Data Analysis. Addison-Wesley (1977)
1977
Earlier work this paper cites.
Van der Maaten, L., Hinton, G.: Visualizing data using t-sne. Journal of Machine Learning Research 9
2008
Earlier work this paper cites.
Chen, Y., Wiesel, A., Eldar, Y.C., Hero, A.O.: Shrinkage algorithms for mmse covariance estimation. IEEE Transactions on Signal Processing 58
2009
Earlier work this paper cites.
Deng, J., Dong, W., Socher, R., Li, L.J., Li, K., Fei-Fei, L.: Imagenet: A large-scale hierarchical image database. In: 2009 IEEE conference on computer vision and pattern recognition. pp. 248–255. Ieee (2009)
2009
Earlier work this paper cites.
Krizhevsky, A., Hinton, G., et al.: Learning multiple layers of features from tiny images (2009)
2009
Earlier work this paper cites.
Lin, T.Y., Maire, M., Belongie, S., Hays, J., Perona, P., Ramanan, D., Dollár, P., Zitnick, C.L.: Microsoft coco: Common objects in context. In: Computer Vision–ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 13. pp. 740–755. Springer (2014)
2014
Earlier work this paper cites.
Fredrikson, M., Jha, S., Ristenpart, T.: Model inversion attacks that exploit confidence information and basic countermeasures. Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security (2015), https://api.semanticscholar.org/CorpusID:207229839
2015
Earlier work this paper cites.
Hinton, G., Vinyals, O., Dean, J.: Distilling the knowledge in a neural network. arXiv preprint arXiv:1503.02531 (2015)
Original
2015
Earlier work this paper cites.
Le, Y., Yang, X.: Tiny imagenet visual recognition challenge. CS 231N 7
2015
Earlier work this paper cites.
Nguyen, A., Yosinski, J., Clune, J.: Deep neural networks are easily fooled: High confidence predictions for unrecognizable images. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 427–436 (2015)
2015
Earlier work this paper cites.
He, K., Zhang, X., Ren, S., Sun, J.: Deep residual learning for image recognition. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 770–778 (2016)
2016
Earlier work this paper cites.
Guo, C., Pleiss, G., Sun, Y., Weinberger, K.Q.: On calibration of modern neural networks. In: International conference on machine learning. pp. 1321–1330. PMLR (2017)
2017
Earlier work this paper cites.
Hendrycks, D., Gimpel, K.: A baseline for detecting misclassified and out-of-distribution examples in neural networks. In: International Conference on Learning Representations (2017), https://openreview.net/forum?id=Hkg4TI9xl
2017
Earlier work this paper cites.
Leibig, C., Allken, V., Ayhan, M.S., Berens, P., Wahl, S.: Leveraging uncertainty information from deep neural networks for disease detection. Scientific reports 7
2017
Earlier work this paper cites.
Loshchilov, I., Hutter, F.: Decoupled weight decay regularization. arXiv preprint arXiv:1711.05101 (2017)
Original
2017
Earlier work this paper cites.
Rebuffi, S.A., Kolesnikov, A., Sperl, G., Lampert, C.H.: icarl: Incremental classifier and representation learning (2017). https://doi.org/10.1109/CVPR.2017.587
2017
Earlier work this paper cites.
Shokri, R., Stronati, M., Song, C., Shmatikov, V.: Membership inference attacks against machine learning models. 2017 IEEE Symposium on Security and Privacy (SP) pp. 3–18 (2017)
2017
Earlier work this paper cites.
Yeom, S., Giacomelli, I., Fredrikson, M., Jha, S.: Privacy risk in machine learning: Analyzing the connection to overfitting. 2018 IEEE 31st Computer Security Foundations Symposium (CSF) pp. 268–282 (2017), https://api.semanticscholar.org/CorpusID:2656445
2017
Earlier work this paper cites.
Pardau, S.L.: The california consumer privacy act: Towards a european-style privacy regime in the united states. J. Tech. L. & Pol’y 23
2018
Earlier work this paper cites.
Magdziarczyk, M.: Right to be forgotten in light of regulation (eu) 2016/679 of the european parliament and of the council of 27 april 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing directive 95/46/ec. In: 6th International Multidisciplinary Scientific Conference on Social Sciences and Art Sgem 2019. pp. 177–184 (2019)
2019
Earlier work this paper cites.
Salem, A., Zhang, Y., Humbert, M., Berrang, P., Fritz, M., Backes, M.: Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models. In: Proceedings of the 26th Annual Network and Distributed System Security Symposium (NDSS) (2019)
2019
Earlier work this paper cites.
Song, L., Shokri, R., Mittal, P.: Privacy risks of securing machine learning models against adversarial examples. Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security (2019), https://api.semanticscholar.org/CorpusID:165163934
2019
Earlier work this paper cites.

Similar

Yang, Z., Zhang, J., Chang, E.C., Liang, Z.: Neural network inversion in adversarial setting via background knowledge alignment. Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security p. 225–240 (2019). https://doi.org/10.1145/3319535.3354261, https://doi.org/10.1145/3319535.3354261
2019
Cited alongside, same era.
Du, M., Yang, F., Zou, N., Hu, X.: Fairness in deep learning: A computational perspective. IEEE Intelligent Systems 36
2020
Cited alongside, same era.
Felps, D.L., Schwickerath, A.D., Williams, J.D., Vuong, T.N., Briggs, A., Hunt, M., Sakmar, E., Saranchak, D.D., Shumaker, T.: Class clown: Data redaction in machine unlearning at enterprise scale. arXiv preprint arXiv:2012.04699 (2020)
Original
2020
Cited alongside, same era.
Golatkar, A., Achille, A., Soatto, S.: Eternal sunshine of the spotless net: Selective forgetting in deep networks. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 9304–9312 (2020)
2020
Cited alongside, same era.
Golatkar, A., Achille, A., Soatto, S.: Forgetting outside the box: Scrubbing deep networks of information accessible from input-output observations. In: Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part XXIX 16. pp. 383–398. Springer (2020)
2020
Cited alongside, same era.
Guo, C., Goldstein, T., Hannun, A., Van Der Maaten, L.: Certified data removal from machine learning models. In: Proceedings of the 37th International Conference on Machine Learning. Proceedings of Machine Learning Research, vol. 119, pp. 3832–3842. PMLR (2020)
2020
Cited alongside, same era.
Han, X., Dai, Y., Gao, T., Lin, Y., Liu, Z., Li, P., Sun, M., Zhou, J.: Continual relation learning via episodic memory activation and reconsolidation (2020). https://doi.org/10.18653/v1/2020.acl-main.573, https://aclanthology.org/2020.acl-main.573
2020
Cited alongside, same era.
Hayase, T., Yasutomi, S., Katoh, T.: Selective forgetting of deep networks at a finer level than samples. arXiv preprint arXiv:2012.11849 (2020)
Original
2020
Cited alongside, same era.
Hsu, Y.C., Shen, Y., Jin, H., Kira, Z.: Generalized odin: Detecting out-of-distribution image without learning from out-of-distribution data. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 10951–10960 (2020)
2020
Cited alongside, same era.
Sommer, D.M., Song, L., Wagh, S., Mittal, P.: Towards probabilistic verification of machine unlearning. arXiv preprint arXiv:2003.04247 (2020)
Original
2020
Cited alongside, same era.
Song, L., Mittal, P.: Systematic evaluation of privacy risks of machine learning models (2020)
2020
Cited alongside, same era.
Wu, Y., Dobriban, E., Davidson, S.: Deltagrad: Rapid retraining of machine learning models. In: International Conference on Machine Learning. pp. 10355–10366. PMLR (2020)
2020
Cited alongside, same era.

Then

Zhao, X., Zhang, W., Xiao, X., Lim, B.: Exploiting explanations for model inversion attacks. 2021 IEEE/CVF International Conference on Computer Vision (ICCV) pp. 662–672 (oct 2021). https://doi.org/10.1109/ICCV48922.2021.00072, https://doi.ieeecomputersociety.org/10.1109/ICCV48922.2021.00072
2021
Later among the works it cites.
Kahla, M., Chen, S., Just, H.A., Jia, R.: Label-only model inversion attacks via boundary repulsion. 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) pp. 15025–15033 (2022). https://doi.org/10.1109/CVPR52688.2022.01462
2022
Later among the works it cites.
Kim, J., Woo, S.S.: Efficient two-stage model retraining for machine unlearning. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 4361–4369 (2022)
2022
Later among the works it cites.
Mercuri, S., Khraishi, R., Okhrati, R., Batra, D., Hamill, C., Ghasempour, T., Nowlan, A.: An introduction to machine unlearning. arXiv preprint arXiv:2209.00939 (2022)
Original
2022
Later among the works it cites.
Nguyen, T.T., Huynh, T.T., Nguyen, P.L., Liew, A.W.C., Yin, H., Nguyen, Q.V.H.: A survey of machine unlearning. arXiv preprint arXiv:2209.02299 (2022)
Original
2022
Later among the works it cites.
Setlur, A., Eysenbach, B., Smith, V., Levine, S.: Adversarial unlearning: Reducing confidence along adversarial directions. Advances in Neural Information Processing Systems 35
2022
Later among the works it cites.
Wu, G., Hashemi, M., Srinivasa, C.: Puma: Performance unchanged model augmentation for training data removal. In: Proceedings of the AAAI Conference on Artificial Intelligence. vol. 36, pp. 8675–8682 (2022)
2022
Later among the works it cites.
Chen, M., Gao, W., Liu, G., Peng, K., Wang, C.: Boundary unlearning: Rapid forgetting of deep networks via shifting the decision boundary. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). pp. 7766–7775 (June 2023)
2023
Later among the works it cites.
Cheng, J., Amiri, H.: Multimodal machine unlearning. arXiv preprint arXiv:2311.12047 (2023)
Original
2023
Later among the works it cites.
Chundawat, V.S., Tarun, A.K., Mandal, M., Kankanhalli, M.: Can bad teaching induce forgetting? unlearning in deep networks using an incompetent teacher. In: Proceedings of the AAAI Conference on Artificial Intelligence. vol. 37, pp. 7210–7217 (2023)
2023
Later among the works it cites.
Cotogni, M., Bonato, J., Sabetta, L., Pelosin, F., Nicolosi, A.: Duck: Distance-based unlearning via centroid kinematics. arXiv preprint arXiv:2312.02052 (2023)
Original
2023
Later among the works it cites.
Jia, J., Liu, J., Ram, P., Yao, Y., Liu, G., Liu, Y., Sharma, P., Liu, S.: Model sparsity can simplify machine unlearning. In: Annual Conference on Neural Information Processing Systems (2023)
2023
Later among the works it cites.
Kurmanji, M., Triantafillou, P., Hayes, J., Triantafillou, E.: Towards unbounded machine unlearning. In: Thirty-seventh Conference on Neural Information Processing Systems (2023), https://openreview.net/forum?id=OveBaTtUAT
2023
Later among the works it cites.
Lin, S., Zhang, X., Chen, C., Chen, X., Susilo, W.: Erm-ktp: Knowledge-level machine unlearning via knowledge transfer. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 20147–20155 (2023)
2023
Later among the works it cites.
Liu, J., Xue, M., Lou, J., Zhang, X., Xiong, L., Qin, Z.: Muter: Machine unlearning on adversarially trained models. In: Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV). pp. 4892–4902 (October 2023)
2023
Later among the works it cites.
Poppi, S., Poppi, T., Cocchi, F., Cornia, M., Baraldi, L., Cucchiara, R.: Removing NSFW Concepts from Vision-and-Language Models for Text-to-Image Retrieval and Generation. arXiv preprint arXiv:2311.16254 (2023)
Original
2023
Later among the works it cites.
Rigaki, M., Garcia, S.: A survey of privacy attacks in machine learning. ACM Computing Surveys 56
2023
Later among the works it cites.
Shaik, T.B., Tao, X., Xie, H., Li, L., Zhu, X., Li, Q.: Exploring the landscape of machine unlearning: A comprehensive survey and taxonomy. CoRR (2023)
2023
Later among the works it cites.
Tarun, A.K., Chundawat, V.S., Mandal, M., Kankanhalli, M.: Fast yet effective machine unlearning. IEEE Transactions on Neural Networks and Learning Systems (2023)
2023
Later among the works it cites.
Tiwary, P., Guha, A., Panda, S., et al.: Adapt then unlearn: Exploiting parameter space semantics for unlearning in generative adversarial networks. arXiv preprint arXiv:2309.14054 (2023)
Original
2023
Later among the works it cites.
Xu, J., Wu, Z., Wang, C., Jia, X.: Machine unlearning: Solutions and challenges. arXiv preprint arXiv:2308.07061 (2023)
Original
2023
Later among the works it cites.
Image captioning dataset, random images. https://www.kaggle.com/datasets/shamsaddin97/image-captioning-dataset-random-images/data , accessed: 2024-02-14
2024
Closest in time.
Yin, Z., Xing, E., Shen, Z.: Squeeze, recover and relabel: Dataset condensation at imagenet scale from a new perspective. Advances in Neural Information Processing Systems 36
2024
Closest in time.

Beyond the bibliography

alphaXiv searches the wider corpus for related work and actual follow-ups.

Open on alphaXiv

alphaXiv is searching for related work…

Reading the bibliography…